SPA session timeout

[qrkourier]

I'm using the console as an SPA served by the controller's mgmt web listener. It's tedious to re-log-in so frequently. I expect to remain authenticated for a few hours, at leasta. I'm unsure what the timeout is precisely, it seems to be an hour or less.

The workaround is to globally increase the edge.api.sessionTimeout value which may be undesirable when it represents a significant change of security posture for a particular network.

Can we improve the user experience by implementing the new authentication method with a longer timeout, refresh token, or by sending an innocuous REST request at some interval to keep the session alive? It might be best for the controller to offer discrete API session timeouts for admin and non-admin. That would help in this case. Still, the newer auth method Andrew's been working on might obviate this pain.

relatedly: #340