Take max_sessions from max_requests.

It's a little high, but it means that a busy server will
automatically be able to handle more EAP sessions.

Otherwise, the server will start ignoring EAP sessions, or
discarding "old" ones that are still in process