Return redirect responses rather than raising.

That's what was breaking auto-commit.
Update User.last_online on every request.

This interacts awkwardly with the ACL stuff, consider removing it and replacing it with decorators instead.