Keep track of last user activity

... so we can prune inactive accounts.

In order to do this, we need to start letting our login sessions expire. The interval should be configurable, with a default of six months. If now - last_login > 6 months, you're probably inactive.