"session" is kept as long as JWT token is not expired. In our case it was 15 minutes by default. I've changed now to 30 minutes (new default) and added option auth-expiration to configure expiration timeout using Duration format, example to set expiration time to 10 minutes:

http () {
    'authProvider' () {
        'auth-expiration' = 'PT10M'
    }
}