One can terminate use sessions but they don't seem to expire automatically. I'd like to set expiration time to 24h, but it would be nice to ask for auth verification for sensitive stuff like changing expiration time, promoting user to admin, expose shared secrets (e.g. password, crypto keys).