Refresh User object on session every fifteen minutes

This currently isn't the case, so I'm wondering if we should spend more work trying to come up with an unauthenticated API or if we should modify the README and examples we have everywhere to reflect this change.

Maybe even make it a new option in the ctor?