only mark notifications as read if the user is really "online"

@davidfowl thoughts?