Oliver,
If timeout expires I expect 'Before change:' to be empty again, thus generating a new token. But it isn't. It still uses the old token. What's going on?
Just for clarification: core session tracking tokens don't expire. Session data objects associated with tokens expire. See the section "Session Id (Non-)Expiration" in the help doc. Your question is still valid, however. The timeout parameter isn't exact. In the current implementation, for example, if your timeout is set to 20 minutes, it could take up to 40 minutes to expire the data object associated with the token. It will expire, however. I need to work on making this more exact, but for now consider the timeout the "minimum" amount of time before a session data object will expire. HTH, Chris