Merge branch 'session_timeout' into 'master'

Expire Rack sessions after 1 week

This has the side effect of preventing Redis from clogging up with old sessions.

See merge request !1042

CHANGELOG

@@ -1,5 +1,6 @@
 v 7.3.0
   - Always set the 'origin' remote in satellite actions
+  - Expire Rack sessions after 1 week
 
 v 7.2.0
   - Explore page

config/initializers/session_store.rb

@@ -6,5 +6,6 @@ Gitlab::Application.config.session_store(
   key: '_gitlab_session',
   secure: Gitlab.config.gitlab.https,
   httponly: true,
+  expire_after: 1.week,
   path: (Rails.application.config.relative_url_root.nil?) ? '/' : Rails.application.config.relative_url_root
 )