3 bug fixes

* Added check for request.path to ensure idleFor parameter is processed only for session_security_ping url
* Assume a negative idleFor value means 0 to prevent a log out but if the value is negative
* Ignore non-integer idleFor values instead of throwing an exception