[Proposal] FileSessionHandler should not open expired sessions 

Currently the garbage collector of the FileSessionHandler deletes session files randomly, based on the lottery values in the application configuration. However, before the gc kicks in, sessions seem to be valid even after the configured lifetime has expired. 
In my opinion, a secure session handler should not open expired sessions. I therefore added this pull requests that checks the timestamp of the session file before reading it.
Missing the docblock for this new param. Should there be a default value, since otherwise this breaks backwards compatibility?