http_static: fix session expiration timer bugs