-# start a new session.
-# by default it'll expire in 24 hours regardless of activity.
-# pass both args for a session that lasts longer if active.
-# sessions are tracked with a "session cookie" (dies on browser close)
-function session_new($idle_timeout = 86400, $max_timeout = 'same_as_idle') {
- if ($max_timeout === 'same_as_idle') {
- $max_timeout = $idle_timeout;
- }
+# start a new session, tracked by a browser "session cookie".
+#
+# args:
+# $idle_timeout (seconds) session ends after this much inactivity (or up to 10% less)
+# $max_length (seconds) session ends after this long, regardless of activity
+function session_new($idle_timeout = 129600 /* 36 hours */, $max_length = 604800 /* 1 week */) {