Refresh User object on session every fifteen minutes

@jbuck it must, because every route this code uses is defined with basic auth middleware on the login server.