LDEV-2449 SSO cookie doesn't seem to expire when shared session ends - therefore set max age to same as session timeout value. Fixes the first click after a session timeout thinking it's still logged in
LDEV-2449 remove key to session in map when session invalidated; don't worry about JSESSIONID cookie at all, let container handle it since we don't use it to store shared session anymore.