Move auth timeout into Auth controller