Update lastupdate before any chances to go wrong.

The error will still be logged and we can deal with those separately.
If we didn't, we'd just try it again next time, the error would repeat
and we'd never check another feed!
Secret to call updateFeed() without login.

Testing with sqlite, only one process can lock the database so we might as
well allow updating to be handled by a quick curl to the api. Managing a
session is annoying so here's a secret.