Possibly breaking change: Session timeouts broken out into activity and session timeouts, config names changed, defaults changed to move in line with OWASP.