add IDLE user status
add session timeout option for embedded servers
use HttpSessionBindingListener to 'logout' users on session timeout
automatically login with #username= fragment