Note that this does nothing more than create a new instance.
The session can later be started explicitly via WebSession.start()
or implicitly by adding attributes -- and then persisted via
Check for expired sessions and remove them. Typically such checks are
kicked off lazily during calls to create or
retrieve, no less than 60 seconds apart.
This method can be called to force a check at a specific time.