fix calculation of session_refreshed_at timestamp

the timestamp stored in the encrypted cookie already represents the
"session_refreshed_at" value. in 1.0.3 we incorrectly interpreted it as
a "expires_at" value, as if it already included the expire_after value