Cannot modify session expiry

It seems when using the `Session` with tide's session middleware, it's not possible to modify the session expiry because it is not wrapped in an `Arc` (I think).

This can be a somewhat tricky thing to reason with because of the session lifecycle in a request (and how it is cloned), but testing reveals that there are two things that would prevent this:

1. the expiry not being wrapped in `Arc` so the cloned session ([via tide session middleware's handler](https://docs.rs/tide/latest/src/tide/sessions/middleware.rs.html#95)) does not update the session expiry
2. `Session::expire_in` does not mark the session `data_changed`, so unless the check is disabled in the middleware, changes to session expiry [will not cause the session to be updated by the store](https://docs.rs/tide/latest/src/tide/sessions/middleware.rs.html#108) even it 1 is fixed

These are relatively straightforwards things to resolve, but may have some more subtle implications since it will change how sessions behave and existing code may be out there which depends on these quirks.