Related: Slack discussion

We currently have a 1 day session timeout hardcoded.

There are cases in which a different timeout (eg 1 hour) is a hard requirement for sector-specific compliance.

It'd be nice if it would be possible to set the default expiry used in session creation.