The admin.session_ttl value was defined in defaults, template, and documentation but never read — sessions had no expiration. Pass it as expire_after to Rack::Session::Cookie. A value <= 0 means persistent (until browser close), matching the documented behaviour.