Following config was mostly copied from instructions given in the following Q/A:
https://stackoverflow.com/questions/34755791/apache-mod-session-dbd-anyone-got-it-to-work

Ubuntu 16.04
Server version: Apache/2.4.18 (Ubuntu)
Server built:   2019-04-03T13:34:47



#-------------------------- DBD configuration ----------------------------------------------------------
    DBDriver mysql
    DBDParams "host=localhost,user=localuser,dbname=session_database,pass=password"

    DBDPrepareSQL "delete from web_sessions where uuid = %s" deletesession
    DBDPrepareSQL "SELECT session FROM web_sessions WHERE uuid = %s AND ('expiry' = 0 OR 'expiry' > %lld)" selectsession
    DBDPrepareSQL "DELETE FROM web_sessions WHERE expiry != 0 AND expiry < %lld" cleansession

    # next two are deliberately made to do nothing regarding update or insert, as php will take care of that part.
    DBDPrepareSQL "select %s, %lld, %s, %s " updatesession
    DBDPrepareSQL "select %s, %lld, %s" insertsession

<Directory "/var/www/html/example/unprotected/">

    #The following sets the uuid cookie if it hasn't already been set.
    <If "%{HTTP_COOKIE} !~ /uuid/">
        Session on
        SessionDBDCookieName uuid
    </If>

    Options Indexes FollowSymLinks
    AllowOverride all
    Require all granted

</Directory>

<Directory "/var/www/html/test/protected/">

    AuthFormProvider dbd

    Options FollowSymLinks
    AllowOverride all
    AuthType form
    AuthName "example"
    AuthFormProvider dbd
    AuthDBDUserPWQuery "SELECT session_pw FROM web_sessions WHERE uuid = %s and expiry>unix_timestamp()*1000000"
    Require valid-user

</Directory>