synchronized void removeTimeouts() {
		long sysdate = System.currentTimeMillis();
		List<String> toBeRemoved = new LinkedList<String>();
		for (String sessionKey : formAuthener.allowed.keySet()) {
			Long lastAccess = formAuthener.allowed.get(sessionKey);
			if (lastAccess == null
					|| sysdate > lastAccess + formAuthener.loginTimeout) {
				toBeRemoved.add(sessionKey);
				log.info("{} exceeds timeout: {}", sessionKey, lastAccess);
			}
		}
		for (String sessionKey : toBeRemoved) {
			formAuthener.allowed.remove(sessionKey);
			formAuthener.sessions.remove(sessionKey);
		}
		toBeRemoved.clear();
		for (Object sk : formAuthener.sessions.keySet()) {
			String sessionKey = (String) sk;
			if (!formAuthener.allowed.containsKey(sessionKey)) {
				toBeRemoved.add(sessionKey);
			}
		}
		for (String sessionKey : toBeRemoved) {
			formAuthener.sessions.remove(sessionKey);
		}
	}