[web] Fix expiry of anonymous sessions (closes #4154479)
Things like:
try:
foo
except:
bar
else:
baz
doesn't work very well if you expect baz to run even in the exception
case. Plus, session.cnx.check() is a dbapi remnant, so drop it and just
look at session.mtime.
