Session Expires at is wrongly used

[avinoth]

Noticed this while doing #37

We are checking the session expiry time here - https://github.com/mikker/passwordless/blob/master/app/controllers/passwordless/sessions_controller.rb#L48 whereas it should use timeout_at. And, the expires_at should maybe used in the authenticate_by_cookie method instead. Correct me if I'm wrong, I may have misunderstood. If not, let me know, happy to send a PR.

[mikker]

You're right. Good catch! PR is very welcome, thank you!