After session timeout, the ajax profile change controls are still active, but do not save anything

[jzakotnik]

[jzakotnik]

We are missing session management at all, right? Should it expire? How to configure tomcat properly?

[Tueffy]

Yes, no session mgmt sofar. We should have a session timeout after 15 min of inactivity

[jzakotnik]

e.g. yammer and gmail don't have session timeouts..