1. update this PR so we don't store an event
2. update the code so we don't respect expired sessions
3. (optional, after this PR) instead of storing in the database, sign the cookie with something like [tokenlib](https://github.com/mozilla-services/tokenlib), ref: #715