Clean up session expiry time

• there's a mismatch in where the session expiration time is stored
  • the initial value is automatically generated and stored via

    expiresOn := time.Now().Add(time.Second * time.Duration(session.Options.MaxAge))
    session.Values["expires_on"] = expiresOn
    

  • auth providers (uaa, local, non) will provide a value in sessionValues["exp"],
  • when returned to user exp is ignored in favour of expires_on (see handleSessionExpiryHeader)
• there should be a way for the authentication mode to set the session expiry time
  • not sure it's as simple as making sure exp and expires_on are the same
• TODO allow session.Options.MaxAge to be set via env var

Start by tracing the session expiry initialization, the auth providers' sessionValues["exp"], and handleSessionExpiryHeader. Determine how authentication modes should control expiry and how session.Options.MaxAge should be configured from an environment variable. Done means the storage and returned expiry behavior are consistent for each authentication mode, with coverage for the relevant cases.