The sessions tuple has two slots which contain configuration parameters:

verify?	If set to a true value, the client IP address and user agent of each session is tracked, and checked every time a client attempts to re-establish a session. While this does not offer any real security, it can thwart unskilled packet-sniffing attacks. On by default.
timeout	A duration storing the maximum time that inactive sessions will be stored on the server. The default timeout is 20 minutes. Note that for sessions to actually expire, you must start a thread to do so; see the furnace.alloy vocabulary for an easy way of doing this.