Enforce session expiration
- Set maxInactiveInterval based on the session-timeout setting
- If the session has not been accessed in more than session-timeout minutes, then invalidate the session and return null

Also, minor cleanup:
- Remove "DynamoSession" downcasts where possible
- Fix compiler warnings
- Clean up logging typos
- Delete the session with the same Key that's used elsewhere. This doesn't change the logic, but it's more obvious that everything is consistent.
Loading a session by ID should not create a new session with the given ID

The interface specifies that findSession should return null if an active session
cannot be found. By creating and returning a new session instead of null, the 
code prevented any protection against a session fixation attack.

Also, clean up a little bit of logging.
Merge pull request #2 from jtoberon/master

Enforce session expiration