Moved session explosion code into CandServiceBase
Fixed regression in cand session authn

The new candidate session authentication filter wasn't specific enough
in the URLs it applied to, which was getting in the way of the asciiMath
helper. This is now fixed here. (However, we may want to restrict access
to the helper so that it can't be used outside sessions...)
Changed cand sessn finish/terminated to timestamps

These two boolean flags have been replaced with timestamps, which will
be more useful for reporting purposes.

The schema migration script has been updated as appropriate. Note that
existing sessions will have their finish/terminated timestamps faked,
which is the best we can do.
Fixed linear nav case not covered in commit b2c4991

The commit b2c4991 only improved the timing of session finish in the
case of non-linear navigation. This commit does the same for linear
navigation, by finishing the session when the final item in the final
testPart is ended.

I have also added a new FINISH_FINAL_ITEM constant to
CandidateTestEventType to make it easy to see when the final item in a
testPart has been ended.