I have added before filter to check if request is json and then invalidate session
manually.
Regular user activity is handled by activerecord session store timeout option. This patch
may need another revision
to set the session timeout time in configuration file, but right now I am not sure where
it should be.
There is another option to make sure all sesions ale expired is to create delayed_job
job for periodicaly checking SessionEntity table.