Configurable Default Expiration Time

This patch makes the default expiration time configurable.

Also, always set an expiration time even if no cookie is present. Setting an expiration for sessions without cookies is useful if the sessions are linked to requests via custom headers.