Improved Cookieless Sessions

* fixed the session timeout
* implemented a maximum session count
* made the URL prefix configurable
* added an option to control session creation

Also added some tests for the above changes.