API session clean-up

[colinmollenhour]

There needs to be an automatic mechanism in place to clean up expired API sessions. I assumed for a long time there was such a mechanism but this table just grows indefinitely without a cleanup script in place to delete expired sessions.

Also with the Basic Auth it would be a good improvement to bypass the recording of the session in the first place since the session only lives for the one request.

See #3443 (comment)