Session key not timing out when set in a plugin
I think you're confusing Craft's userSessionDuration - which is the amount of time that you can stay logged into the control panel - with PHP's session (which is what craft()->httpSession is a wrapper for).

When you get logged out of the control panel, the former userSession is killed, but you still keep the same underlying PHP session ID and cookie.