Testing OTP is controlled from pwa_config.php. Session stays active until logout.