Allow for custom expiration based on request

[mjschultz]

This breaks out an get_expire_seconds method that simply gets the EXPIRE_AFTER value from the config. My thinking is that this should allow things like #58 to be solved by the end-user easily though creating a new middleware that overrides the get_expire_seconds method. For example, if they want per-user settings they'd have to create a User Profile model to store the timeout, then they could just do something like:

class MySessionSecurityMiddleware(SessionSecurityMiddleware):
    def get_expire_seconds(self, request):
        try:
            return request.user.profile.session_timeout
        except Exception:
            return settings.EXPIRE_AFTER

(* example not guaranteed to work)