add expire_session action to application_controller.  if param redirect=false is appended, then no redirection to root_path takes place