Like a "secure mode" that a user could set (with domain and possibly server-wide override ability) on their account that auto-logs them out after x number of minutes of inactivity on webmail.  

I'm a +1 for this feature.

Forcing things on the client side is [edit] not necessarily an option.  It [end edit] needs it to be server side for users who "walk away" - where it basically auto-logs out a user per "user settings or domain settings" and ignores the "remember me" box on login.

Incognito mode does nothing to auto-logout a session unless the browser window is closed.  Imagine a hospital - when the terminals are inactive for 10 minutes, they auto-lock -- this is basically what he's asking for -- and in reality it's not too far-fetched of a request considering some of the clients we may encounter in the medical or legal industry, per say.