#469, #506 - Fix session timeout properly.

Change needed to be in web.xml, not webdefault.xml. Jetty's internal
web.xml overrides whatever is defined in webdefault.xml. Web app's
web.xml is used towards the end and can override Jetty's web.xml.