Thanks for the question Jonathon, I actually did do some debugging
similar to what you recommended.
The answer to my confusion is:
I manually set beaker.session.cookie_expires and session.timeout and
got some very wacky behavior (e.g. inconsistent across browsers/
platforms).
My caveat to people is to stick with the defaults unless you *really*
understand what's going on.