code: protected function sessionTimeoutCheck($configKey, $sessKey, $clear, $alwaysUpdate = false)
      {
          if ($this->config[$configKey] !== false) {
              $t = time();
              if ($this->session->has($sessKey)) {
                  if ($this->session->get($sessKey) < $t - $this->config[$configKey]) {
                      if ($clear) {
                          $this->session->invalidate();
                      } else {
                          $this->session->migrate(true);
                      }
                      $this->session->set($sessKey, $t);
                  } elseif ($alwaysUpdate) {
                      $this->session->set($sessKey, $t);
                  }
              } else {
                  $this->session->set($sessKey, $t);
              }
          }
      }
docs: Checks the session timeouts
  
  Checks multiple session timeouts and applies the appropriate
  actions, see the usage in {@see PicoAuthPlugin::init()}
  
  @param string $configKey The configuration key containing the timeout value
  @param string $sessKey The session key with the deciding timestamp
  @param bool $clear If set to true, the session will be destroyed (invalidate)
  If set to false, the session will be migrated (change sessid)
  @param bool $alwaysUpdate If set to true, the timestamp in the session (under $sessKey)
  will be updated on every call, otherwise only on timeout