Session: split timeout message into 2 strings

* Removed HTML markup from the strings.
* This allows the updated timeout message to work in 3.x and 4.0.