Define auth & session timeout/max_age.
Request user to re-enter its password on password change
after a short timeout of inactivity from last login and
previous password change.
Add form to manage SSH keys.