Any particular reason you want to set the timeout to an arbitary value of 200 or do you just want the session variables to remain indefinately?
If its indefinately then check that the user has been authenticated and populate the session variables accordingly