Track user activity in the response, not the request.

This allows us to authenticate the request later, in the view. Previously, user activity wasn't tracked properly if the user wasn't authenticated by the time the middleware processed the request.