so i can understand two factor authentication, but why do you still time my session out after 30 minutes?