Check whether sessions time-out

[duffee]

make sure that sessions properly expire after their time out.

[duffee]

The cookie loses it's username attribute but $self->session('logged_in') is still true. A Mojo bug?

[duffee]

Need to finish with a return undef; at the end of the is_logged_in() method in order to prevent further access.