force sessions to timeout

Currently horde relies on session.gc_maxlifetime only to
enforce session timeouts.

Especially on systems where gc_probability needs to be low for
performance reasons or on low traffic servers this is a serious
problem, since sessions might be significantly longer valid, than it was
intended by the admin when he sets conf['session']['timeout'].

Therefore we should always check the last modification of the
session and deny authentication if the session should have timeouted.