Implement session expiration

[michael]

We currently create a lot of session entries, without ever deleting them. We should

a) have an expiration timestamp (2weeks) for each session b) delete all sessions that are expired from time to time.