Make session timeout configurable.

Introduce two new settings variables:
- session.timeout
- session.reissue_time