Allow session only expiration

Now it's possible to set session.expires=0 in config and the session will expire when the browser is closed.
Fix compilation

And small refactoring
Too much copy-n-paste
Fix suggestions from Rob
Fix sessionTimeoutExpiredOrMissing, rearrange else ifs
Remove extra space
Merge pull request #327 from ottob/master

Allow session only expiration