changed method of determining timeout in _authen_config() from examination of user.designation to whether user has the do_admin function, so user can keep descriptive designation and still get admin timeout setting