Make session timeout customizable by overriding configureSession()

5 seconds is a little to short for me.

This let a chance to the user to specify desired timeout, by overriding configureSession().