Refresh User object on session every fifteen minutes

an unauthenticated API that spits out userdata doesn't sound like a good idea.