Ensure cookies are tied to browser session only

Previously rack:session cookies where set to the same TTL as the
backing redis key via :expire_after.

Switch to using expire_in which sets redis key TTL only, leaving the
cookie tied to the current browser session only.
Merge pull request #6 from ausaccessfed/bugfix/#6-sessions-persist-3600-instead-browser-session-only

rack session is persistent for 3600 seconds and should actually be persistent for browser sessions only