absolute auth timeout

Fixes #4317