Expire PGTs according to SESSION_COOKIE_AGE

This also fixes a bug where delete_invalid_tickets() was deleting
PGTs based on the MAMA_CAS_TICKET_EXPIRE value.
Update session expiration documentation