ensure users must authenticate every week (issue #309).  Also, move all magic numbers out of implementation and into the configuration abstraction.