Short sessions are obscurity...not security. If you use a serious website like Fidelity's, they don't let you do anything impactful without an authentication challenge. You could have logged in a few seconds ago...want to tinker with bank accounts? Challenge.