Make session-timeout configurable before deploying

The oportunity to change the session-timeout by creating a web.xml file with the wanted configuration, which is then integrated into the web.xml file used by the server, is not present. This feature is quite natural, according to me, as different companies have different security policies and need different session-timeout time.