We use the session as it's the only place where we can store sensitive information and be sure that it is removed again. And the timeout is used to have automatically logout when the user have been inactive for a configurable period of time.