Session timeout is configured in WEB-INF/web.xml. Add the following at the bottom of the file:
<session-config>
<session-timeout>240</session-timeout>
</session-config>
</web-app>
}}
(Obviously, the {{</web-app>}} is already there, but this just gives you a better sense of where to put it.)