Just put a "trust this browser" checkbox on the sign-in page and adjust the session timeout accordingly. That works. It defaults to the "safe" behavior, but al

Just put a "trust this browser" checkbox on the sign-in page and adjust the session timeout accordingly. That works. It defaults to the "safe" behavior, but allows users to self-select into other behavior that they find less objectionable. FWIW, my end-users are using public computer labs, so we have to build for the worst-case in terms of user security habits.