Yep. That is the answer. We have a web product that same thing sort of would happen. Clients leave it sitting for hours and then come back to it and expect it to work. I set a time out and then at the end of the timeout kill off all of the session variables and make them log back in again, tossing them out to the main domain. That was about the only way to solve it and even then they would STILL try to hit the back button and keep going where they left off.
www.HawaiianHope.org - Providing technology services to non profit organizations, low income families, homeless shelters, clean and sober houses and prisoner reentry programs. Since 2015, We have refurbished over 11,000 Computers !