Move call to _save_session_expires to finalize_session

Move call to _save_session_expires to finalize_session

_save_session_expires got called in finalize_header, because it
implicitly also extends the session expiry which in turn influences a
possible session cookie which has to be finalized before finalizing
headers.

This patch moves the call to _save_session_expires to finalize_session
with the rest of the _save_* calls and only leaves updating the
session_expiry in finalize_header. This is needed as base for a patch to
Catalyst::Plugin::SubRequest which will allow starting new sessions from
within a subrequest.