No state should be static

If state is static, then multiple applications within the same servlet container interfere with each other. For example, they cannot have different session-timeout settings.

Also, two changes to help debug session expiration problems:
- move the session timeout settings message to a more accurate/useful place
- log details when a session expires