• Session expires after 1 hour of inactivity
• Max 3 failed attempts before lockout