Ah, I see — thanks for clarifying!
An alternative approach that should work on all browsers and might be less annoying for users would be to keep track of the last time a user logged in, and on every page access compute how long ago that was, and if it’s greater than N {days,hours}, then force them to re-authenticate.
And of course N should be configurable; security and user annoyance would both have an inverse relationship to the size of the value.
Google does this with my Google Apps accounts (with 2FA enabled) — they force me to re-authenticate once a month, but it’s pretty smooth.