Analyze session configuration — timeout, regeneration, cookie flags, logout invalidation, and token entropy.