https://ones.com/blog/knowledge/implementing-robust-session-timeout-policy/