Require last_request at for timeoutable sessions