call sessionModel.validate at intervals
improve the session reaping logic.

 * allow validate to return a promise before calling again
 * change sign of timeout length so that it makes sense
Assign module export properly