Strict timeouts for devise-authenticated sessions