Wow, this is expensive!  Do we have any idea of how long it would take?  Will this lock the sessions table?

It's too bad there isn't a user_id column on the sessions table, I wonder why not?

We could also use a customized `@login_required` decorator that checked the UserStanding data, but I guess that would spread the pain to all users...