> Store password hashes using Bcrypt (no salt necessary - Bcrypt does it for you).
In PHP, I would rather recommend to use password_hash() with its own defaults since it's built-in and designed specifically for this purpose - and quite future-proof. But this is PHP specific.
> [] Destroy all active sessions on reset password (or offer to).
> ...
> [] Destroy the logged in user's session everywhere after successful reset of password.
I believe these are the same. The second one is clearer though.
I think the first one is saying "destroy active sessions when a user attempts to change their password" and the second one is saying "destroy active sessions when the user succeeds in changing their password."
In PHP, I would rather recommend to use password_hash() with its own defaults since it's built-in and designed specifically for this purpose - and quite future-proof. But this is PHP specific.
> [] Destroy all active sessions on reset password (or offer to).
> ...
> [] Destroy the logged in user's session everywhere after successful reset of password.
I believe these are the same. The second one is clearer though.
Edit: clarified