LDEV-2475 Changing the implementation to use the temp dir specified in the config table instead of the java default. This means that the temp dir has to be cleaned for every restart of the lams server
LDEV-2472 according to stacktrace, hibernate flushes session at beginning of findById(userId) call, so don't remove child object until after any hibernate ops
LDEV-2449 invalidate session when user has lost their cookie, so we don't accidentally access a page without knowing the right session id/cookie value (for some reason jboss gets confused and returns a 'Session already invalidated' error in an exception)
LDEV-2449 SSO cookie doesn't seem to expire when shared session ends - therefore set max age to same as session timeout value. Fixes the first click after a session timeout thinking it's still logged in
