Best Practices for Timing Out a Web App?

I'm building a small corporate app.  With it, the Membership & Roles functionality of ASP.Net 2.0 will be employed.  So the user will first be brought to a login page where he must login to do anything else.  When he's finished, he should logout.
But we all know most users.  They forget.  So I did some research to see what I could do to forcibly log the user out after an extended period of inactivity.  The best I've come up with so far is to add the following code to the Page_Load event of my master page:
    Response.AddHeader("Refresh", Convert.ToString((Session.Timeout * 60) + 5));
    if (Session.IsNewSession)
      Tools.PageRedirect("~/Login/login");
Let's say that Session.Timeout = 5 minutes.  The user will be logged out and taken back to the Login page after 5 minutes & 5 seconds of no interaction with the server.&n ...