Session timeout setting

Adds a `who.timeout` setting to the config, defaulting to 3600 seconds (1 hour). After that period of inactivity, the user is logged out. Related to #1943.