This week's book giveaway is in the OCMJEA forum. We're giving away four copies of OCM Java EE 6 Enterprise Architect Exam Guide and have Paul Allen & Joseph Bambara on-line! See this thread for details.
Actually, Giulietta, you were correct the first time; session-timeout is expressed in minutes. "... The specified timeout must be expressed in a whole number of minutes. If the timeout is 0 or less, the container ensures the default behaviour of sessions is never to time out. If this element is not specified, the container must set its default timeout period." from the Servlet 2.4 spec.
Also, timeout is not precise. It may take minutes more to actually timeout.