Don't save downgraded authentication level/states. This prevents automatic downgrading from L_STRONG to L_UNAUTH after a while.

Additionally, if state expired more than 60 days ago, assume browser was inactive and should be signed out.

Fixes #31