In my installations session timeout does not work. By default, timeout is occurring after 5 inactive minutes regardless of configuration in System Settings > Session Timeout.
I have tried this by setting http_timeout to 900, but failed.
I get a session time out always at 0 a. m. local time. System Seetings > Security > Session Expiry is greater 50 h.
For me it could be more convenient if I have to reenter my password only after Session Expiry-time an not at 0 a. m.