add 'last_activity' column to session tokens and delete old ones via a background job