added optional expiration to Session object and added check for expired
session during authentication.