If a user opens the Manage Project page within the re-authentication time, then spends a long time authoring project information and then submits forms, the action page will trigger re-authentication and form data will be lost.

The solution is to have re-authentication only triggered by form page, but action page only do form token validation and not re-authentication. This way, it will be consistent with timeouts for authoring issues, which is order of hours and not minutes.