Allow session only expiration

Now it's possible to set session.expires=0 in config and the session will expire when the browser is closed.