Refresh User object on session every fifteen minutes

Why not by user id?

Also, does this loginURL have credentials?