Could fix an edge case where user is logged in, but hasn't confirmed the auth code (so the user is not actually logged in), and then an update appears.
Also prevents if someone is logged in, then another uses force 2FA, and then update appears for the original user.