I do that mainly because: 1. The machine should be able to easily spare the connections. 2. I think it's faster to use an existing open connection than to close and re-open them. 3. If it's set too low, people who don't accept the cookie will get logged out after too short a period of inactivity. Personally, I'd prefer timeouts along the order of 24 hours, so people can stay logged in most of the time. Think I should cut it back to 300 seconds for tomorrow just to see what happens? I'm TS'd into it right now.