By having the following stanza in web.xml you are then required to modify the portal WAR file for a simple configuration change. From the docs for session.timeout in the portal.properties:
"Specify the number of minutes before a session expires. This value is always overridden by the value set in web.xml."
I propose that it be removed.