LDEV-2449 invalidate session when user has lost their cookie, so we don't accidentally access a page without knowing the right session id/cookie value (for some reason jboss gets confused and returns a 'Session already invalidated' error in an exception)
LDEV-2449 SSO cookie doesn't seem to expire when shared session ends - therefore set max age to same as session timeout value. Fixes the first click after a session timeout thinking it's still logged in