REVIEW (2.7): [NEXUS-6189] backport 2.7 session timeout

Port session timeout and www-authentication ommission changes to 2.7

https://issues.sonatype.org/browse/NEXUS-6189