At phpbb.com in thier forums there is quite a bit of info on Invalid Session errors. Basically they suggest setting it at 3600 seconds which is 60 minutes, anything longer could lead to a breach in security by someone stealing a session ID.