fix of #115 - stay connected and session livetime

this can be treated as a quick fix of the problem.
all is now working as expected: in "stay signed" is not checked, session will expire at the end of browser session or after 1 hour of inactivity. if checked - after 90 days.
Tested for session autostart = true and also for false, so all should be ok in various environments.
However, I think, we may require deeper refactoring of session handling in near future.