Allow overriding of session lifetime

[brontolosone]

Related: Slack discussion

We currently have a 1 day session timeout hardcoded.

There are cases in which a different timeout (eg 1 hour) is a hard requirement for sector-specific compliance.

It'd be nice if it would be possible to set the default expiry used in session creation.

[srujner]

Hey I've two questions regarding this PR:

1. How does the system behave if an invalid or extreme value is set (e.g., 0 minutes, several days)?
2. Does this change affect only new sessions or also existing active sessions?