This was discovered by pferre22 while testing the new recent courses functionality.

It seems that calls to user_accesstime_log() (to update user access time to a course) are located in require_login and require_course_login functions.

This is not the correct place because it means that every time a WebService function evaluates a course context via validate_context (even if the user is not accessing the course, just for checking if he can effectively access) the access time is updated.

Right now, for example, the last access time for all the user courses are updated every time a user access the Course overview page in the Mobile app (again, without accessing to any of those courses).