Correct variable name to avoid confusion

The tenth returned value (index 9) of stat() is the mtime, not the
ctime, as documented in `perldoc -f stat`.  ctime is index 10, the
eleventh returned value.

Sessions stored in the database are cleared by their last updated time;
mtime, not ctime, is the appropriate file-system analogue.  Targeting
creation time also makes no sense, as it will logout still active
sessions.