timeout on form based security

[simone cecchini]

dear colleagues,
i have noted that, when using form based security (tomcat 3.2.1), a kind of expiration 
is on: if i connect to a secured page (actually a servlet) and stay inactive for a 
while (not sure about the lapse) when i reload the page or try to connect to another 
resource, i have to re insert username and password.
am i right? which parameter have i to change to prevent tomcat to do this?
thanks,
simone