Auto-logout after an hour of inactivity would be far better, and could have easily been added days ago.