Sorry, still haven't had time to look into it... might be a week or two, I move slowly on these things some months.

The authentication routine we use in version 2.x is an external one, and I know it has a time-out variable set. I would have to glue on some cookie code either in the auth routine or the main OJ module. In other words, it's going to take an hour or two and some concentration.