The user must log into a web-based sessions that will timeout after a period of inactivity.