Agreed - this is a much better approach. The "session" that can do the normal daily tasks for users should last as long as you can make it. The "session" that

Agreed - this is a much better approach. The "session" that can do the normal daily tasks for users should last as long as you can make it. The "session" that can do things like change 2fa/billing/contact-info (decidedly not-normal things) should last for exactly as long as it takes you to complete that form, and should require your pass/2fa again to touch. This is currently Google's approach, and I find it much more sane.