Sessions aren't set to expire, so I think we actually need to call update_last_logged_in on every request. I guess it's more "last visited" than "last logged in." The goal is basically to pull people back in if they haven't looked at the site in a while.