Users should record a course last_seen_at value
the problem: we want to be able to disable accounts that have not been used in a long time.
the solution: the token system should update the user record when it refreshes the token, but it should not do this very often. the last_seen_at for user documents does not need to be more fine grained than a month, so the token system would need to update a user's last_seen_at at most once a month.
(from redmine: created on 2015-05-25)