Logout after inactivity

[Luke-Oldenburg]

Summary of the problem

Closes #7258
Supersedes #7303 and #7408

Describe your changes

[sampoder]

I think we should be setting expiration_at and not bringing back peacefully expired. See #8950

[Luke-Oldenburg]

The job malted wrote wouldn't have worked well because of the timing of expiration so I refactored the logic to signed_in_user in SessionsHelper.

[sampoder]

lgtm! @davidcornu can you take a quick look?

[davidcornu]

Save for #11596 (comment), LGTM.

[garyhtou]

Question: Does this mean that someone would keep a session forever alive? I feel like we should at least force users to sign in every X period (maybe at least every months; or 2 weeks).

[Luke-Oldenburg]

Question: Does this mean that someone would keep a session forever alive? I feel like we should at least force users to sign in every X period (maybe at least every months; or 2 weeks).

#11596 (comment)

[garyhtou]

Thanks for surfacing that comment. I do strongly believe that there must be a hard time limit on sessions. We shouldn't allow sessions to exist forever.

[Luke-Oldenburg]

I would agree with that.

[garyhtou]

@sampoder, did you have any further thoughts here?