refactor userauth timeout to be configged