add middleware to be able to expire inactive sessions after N seconds

This PR adds an optional feature to expire inactive login sessions after N seconds. This feature is enabled via a configuration setting:

SESSION_INACTIVITY_TIMEOUT_IN_SECONDS

If this setting is not present, this feature will be disabled.