Session timeout fixes

These two commits make it easier to set up a robust session timeout for a site.

 * `Session.timeout` now has a useful function, specifying the time of inactivity needed for a session to time out, rather than the total session duration.
 * The CMS ping can be turned off optionally, making that time of inactivity mean something genuine.