I just killed old sessions with this:

`update participants set session_token=null where session_expires < now();`

Looks like we don't reset `session_expires` in `Participant.end_session`, which is also a bug. But we should probably clean up such things in a separate PR, eh?