Session store should only update expiry unless changed param is true

[plaliberte]

The session store currently performs a full set when a session object is unchanged. If the object is not changed we should only update the expiry rather than reposting the entire session object.

This will help avoid issues with the following case:

1. Start long running request
2. Destroy session in a separate request
3. Long running request finishes

With a full post of the session the long running request will put the session back in the store effectively cancelling out the session destroy.