util,server: make Shiro session timeout configurable

Signed-off-by: Pierre-Alexandre Meyer <pierre@ning.com>