I'm not mad. Login timeouts are good security.
Not really. A session token has a lot more entropy and is far harder to crack than a user's password. Session tokens shouldn't last forever but that's why rolling tokens are a thing. You should use a valid token to periodically refresh the token for a new one, and expire the previous one.
It's less secure to repeatedly sign users out and force them to request new session tokens by re-transmitting their password to the server. The less times you have passwords going over the wire (even if encrypted) and being stored in the server's memory, the better.