Break down session length per app

It might make sense to use `api.config.app` here too, but its not really important.