Add 'session_duration' attribute to SessionFactory

Session backends may need to limit the validity of sessions
regardless of cookie duration.  Rather than let every SessionFactory
add their own attributes, we should standardize it.