This would seem to be the wisest of the available solutions. Modifying the web.xml of the tersus web application wouldn't survive an upgrade of tersus. Having it available in Configuration.xml is good, but it might be valuable to provide a system property to override that. Something along the lines of tersus.application_name.session_timeout.
Is request_timeout even what is being asked about, though?
For best results, use the Firefox browser..