do not update last_request_at while masquerading

Prevent updating `last_request_at` for real user while we are working with login using masquerading.