Avoid updater race conditions

Don't initialize the updater twice when logged in.

When the session is first loaded, only initialize the updater if there
are no logged in users in the session. If there are, the updater will
be initialized by the watcher.

Protect against duplicate initializations by ignoring onopen callbacks
that fire on a stale updater.

Fix #1307