use the configurable session property name, close #184
don't invalidate a non-authenticated session, closes #185
Merge branch 'next'
0.5.2