Log out users with empty session activity time when session lifetime is enabled.
Always set session[:updated_at] to avoid logging out users when the administrator turns on session expiration.
Refactor session_expired? conditions.
Add changelog entry.
Set updated_at immediately after login.
Add cuke for login/logout and session lifetime.
Only set updated_at for logged in users and not for anonymous users.