Security features get worse when they surprise people. In Generations and Reflections, I built a session monitor that warned before sign-out, let the user extend the session with a small interaction, and fixed the timer bugs that could have signed them out anyway.