EDIT:

By the way on the server you'll find a sample script /extra/clean_sessiontokens.php that you can use in a scheduled task on your server to delete periodically the session tokens older than XX days (there's a variable inside it called CLEAN_FROM_DAYS that you can assign), you could create a scheduled task to run once per week for example (most providers allow you to set scheduled tasks, but this depends on them; alternatively you have to do it manually as above). If you're going to use this file in a scheduled tasks then I suggest to duplicate it and move in a folder where the web users cannot access (theoretically the extra folder shouldn't exist on server unless you have some files of your own, that folder is meant to contain sample scripts), so that you don't need to re-apply changes eventually after a server update if you edit it.