AuthCore: fixed session extending + purge expired + FIXME comments

Many improvements to AuthCore, however, there are some outstanding
issues which have been docuemnted at length in the comments. See in-code
comments