user update should proc with api key and cookie login too

src/main/java/com/commafeed/backend/service/UserService.java

@@ -43,6 +43,27 @@ public class UserService {
 		if (user != null && !user.isDisabled()) {
 			boolean authenticated = encryptionService.authenticate(password, user.getPassword(), user.getSalt());
 			if (authenticated) {
+				afterLogin(user);
+				return Optional.fromNullable(user);
+			}
+		}
+		return Optional.absent();
+	}
+
+	public Optional<User> login(String apiKey) {
+		if (apiKey == null) {
+			return Optional.absent();
+		}
+
+		User user = userDAO.findByApiKey(apiKey);
+		if (user != null && !user.isDisabled()) {
+			afterLogin(user);
+			return Optional.fromNullable(user);
+		}
+		return Optional.absent();
+	}
+
+	public void afterLogin(User user) {
 		Date lastLogin = user.getLastLogin();
 		Date now = new Date();
 
@@ -60,24 +81,8 @@ public class UserService {
 			feedSubscriptionService.refreshAll(user);
 		}
 		if (saveUser) {
-					userDAO.saveOrUpdate(user);
+			userDAO.merge(user);
 		}
-				return Optional.fromNullable(user);
-			}
-		}
-		return Optional.absent();
-	}
-
-	public Optional<User> login(String apiKey) {
-		if (apiKey == null) {
-			return Optional.absent();
-		}
-
-		User user = userDAO.findByApiKey(apiKey);
-		if (user != null && !user.isDisabled()) {
-			return Optional.fromNullable(user);
-		}
-		return Optional.absent();
 	}
 
 	public User register(String name, String password, String email, Collection<Role> roles) {

src/main/java/com/commafeed/frontend/auth/SecurityCheckProvider.java

@@ -67,7 +67,10 @@ public class SecurityCheckProvider implements InjectableProvider<SecurityCheck,
 			HttpSession session = request.getSession(false);
 			if (session != null) {
 				User user = (User) session.getAttribute(CommaFeedApplication.SESSION_USER);
-				return Optional.fromNullable(user);
+				if (user != null) {
+					userService.afterLogin(user);
+					return Optional.of(user);
+				}
 			}
 			return Optional.absent();
 		}