adds activeDuration, default 5 minutes

if a user has an active session, such that they make a request, and the
expiration of their session is within the activeDuration value, their
session will be extended by the same value.

fixes #2