Introduce SESSION_TIMEOUT (1h) and PERMANENT_SESSION_LIFETIME (30d)