Add session timeout (30 minutes).
Discard 'timedout' flash message.
Change session store from cookie to cache.