Pass the session to the controller's `last_request_update_allowed?` method

This patch passes the calling-session through to your controller's `last_request_update_allowed?` method to enable a developer to not update `last_request_at` for a given session, if there are multiple existing sessions.

I use it like this:
```
class ApplicationController
  ...
  def last_request_update_allowed?(session)
    sesson.id != UserSession::SECURE
  end
end
```

(The slightly odd choice of base for this branch is because I need this to work on my Rails 3.0 app too.)