Sessions, not tokens: idle 8 hours, 24 hours at most, revocable at once. Five failures lock the account for 15 minutes.