Use a last_seen value to enforce user re-login after a session expires

- add an expiry field to the settings.
[#69131848]