Allow session only expiration

Now it's possible to set session.expires=0 in config and the session will expire when the browser is closed.

This seems to work for me, but I might have missed something.