session expiration time should be based on session.gc_maxlifetime value ...

session expiration time should be based on session.gc_maxlifetime value, and only in case session.cookie_lifetime is larger - on session.cookie_lifetime

otherwise, in case session.cookie_lifetime=0 (cookie lifetime limited to browser session lifetime), session is saved as permanent in redis and will never expire