Session Timeouts: The Overlooked Accessibility Barrier In Authentication Design