fix: treat unlocking the session as user activity