session expiration time moved to Rails.configuration