I am not sure if this is intended but webmin doesn't timeout if user login and stay on dashboard.
Dashboard is set to refresh every 5 sec, I think this is why it doesn't time out and logout the session.
I think we need to handle timeout some other way to make sure logged in session not being misused.