Session timeout is configured in WEB-INF/web.xml. Add the following at the bottom of the file:

    <session-config>
        <session-timeout>240</session-timeout>
    </session-config>

</web-app>
}}

(Obviously, the {{</web-app>}} is already there, but this just gives you a better sense of where to put it.)