Added session expirations in the log-in logic

For additional security.  This takes care of 10371 and 10373: I
explained to Ian how the site handled attendance, and he agreed that as
long as the session was secure, there was no need for additional log in