Session length before re authentication

Thirty days, sliding, so it renews itself on activity rather than expiring on a fixed clock as long as the member keeps coming back.

Confirms what we saw, stayed logged in for weeks without doing anything special.

Would be nice if this were configurable per tenant for stricter security policies.

Thirty days matches what we have observed, seems to renew fine as long as we keep using it.