Enforce session expiration

- Set maxInactiveInterval based on the session-timeout setting
- If the session has not been accessed in more than session-timeout minutes, then invalidate the session and return null

Also, minor cleanup:
- Remove "DynamoSession" downcasts where possible
- Fix compiler warnings
- Clean up logging typos
- Delete the session with the same Key that's used elsewhere. This doesn't change the logic, but it's more obvious that everything is consistent.