Some session cleanup.

We do not use the beaker session, so we do not need to
load the middleware.
The Auth Session Cookie of repoze.who will only be valid for 10 minutes.