I wrote a blog post about this. We had to do this at work, and this solution seems to fit our needs.
You should add last_request_at and logged_in to your user model. last_request_at can be grabbed from the user_session information on the request. Logged_in should be set on sign_in / sign_out.