Real site (admin uses SSL) the shop front gives a session timeout warning, it does not auto login.
...because the link was being built without SSL due to admin/includes/configure.php
define('ENABLE_SSL_CATALOG', 'true');
was set to false (incorrectly).