Restrict user's timeout does not modify current session

Testing #3625, I edited a user who had no timeout restriction in their session to be logged out after a minute of inactivity. That didn't work and looking at the session in MongoDB I saw that the `timeout` field for the session was not updated until the user logged-in again.

## Expected Behaviour
Editing the user's timeout settings should update current session or invalidate it.

## Current Behaviour
Editing the user's timeout settings only have effect after the user logs out.

## Steps to Reproduce (for bugs)
1. Log in with a user with no session timeout
2. Change the user's timeout settings to something low, to verify it easily
3. Go to any page and see that the user is never logged out
4. Log out and log in again
5. Go to the same page as before and see that the user is logged out after the timeout is exceeded

## Your Environment
* Graylog Version: Graylog 2.3.0-SNAPSHOT (4802bbb), Graylog 2.2.2 is most likely also affected