#469, #506 - Fix session timeout properly.

Proper fix for issue #469. Earlier "fix" was #506. It was wrong.

Sorry. I had mentioned on the [thread]() that the change should be on web.xml. But, in #506, I changed webdefault.xml by mistake. Jetty's internal web.xml overrides whatever is defined in webdefault.xml. However, the webapp's web.xml is used towards the end and can override Jetty's web.xml.