Remove expired SessionUsers

[donaldgray]

All auth interactions will result in the creation of a SessionUser.

These are fairly short lived and have a set expiry. This expiry is extended when they are used, however we could end up with a table full of sessions that have expired.

Create something that clears down expired SessionUser records periodically - this could be done as part of check in webapp or as a separate daemon job.