The sessions tuple has two slots which contain configuration parameters:

verify?	If set to a true value, the client IP address and user agent of each session is tracked, and checked every time a client attempts to re-establish a session. While this does not offer any real security, it can thwart unskilled packet-sniffing attacks. On by default.
timeout	A duration storing the maximum time since a session was created or its variables were changed. The default timeout is 20 minutes. Expired sessions are rejected on lookup. To delete expired rows from the database, start the cleanup timer provided by furnace.alloy.