Do PHP sessions timeout by default - ie without any coding on my part would a user eventually be "logged out" after some time of inactivity?
Yes typically, a session will end after 20 minutes in PHP.