`renew` and `timeout` config keys should be optional for non-authorities

[xeger]

It makes no sense for an app to concern itself with these config items if it can't produce sessions to begin with and only consumes them.