pub const SESSION_TTL_DAYS: i64 = 7;
How long a newly-created session is valid before the middleware treats it as expired. Not configurable in 0.4.0 — kept fixed so the security surface stays small.