Define timeouts and request limits for authenticated sessions

[marsella]

Currently, the systems architecture section of the specification defines sessions that allow exactly one operation after successful authentication.

In practice, this is inefficient. A better approach is to set a reasonable heuristic for the number of requests that can be made for a single authentication, and to set a timeout for how long a session can be open (in general, and without an active request).

This should be defined for both a registration session and a request session.

[indomitableSwan]

Additional considerations include the nature of the given request, i.e.., some requests are more sensitive than others.