Enforcing sane values for session timeout