Add current_session_id to the user model, update on login

when we change the last logged in time, set the current session id to
a random uuid

this way, we can compare it to the cookie a user has, and if they
differ then we can log them out

also update user.logged_in_at at 2FA rather than password check, since
that feels more accurate

app/models.py

@@ -73,6 +73,7 @@ class User(db.Model):
     failed_login_count = db.Column(db.Integer, nullable=False, default=0)
     state = db.Column(db.String, nullable=False, default='pending')
     platform_admin = db.Column(db.Boolean, nullable=False, default=False)
+    current_session_id = db.Column(UUID(as_uuid=True), nullable=True)
 
     @property
     def password(self):