Yep, I've thought about that problem on-and-off for a long time now: I think an API will emerge at some point; it makes sense from too many points of view for it not to.

Yep, session-expiry is on my list (it's actually something that I've touched very recently).