Add 'session_duration' attribute to SessionFactory

Session backends may need to limit the validity of sessions
regardless of cookie duration.  Rather than let every SessionFactory
add their own attributes, we should standardize it.
Merge pull request #162 from dagolden/topic/session-duration

Add 'session_duration' attribute to SessionFactory