making session cookie parameters configurable

SESSION_EXPIRE_AT_BROWSER_CLOSE and SESSION_COOKIE_AGE