Implement a timeout

Unfortunately, there isn't a sane way to implement ticket refresh inside `auth_tkt`, but implementing timeouts is easy enough.