PEAR AUTH - Login Session not expiring?

Hi All, Trying to use the PEAR Auth library. I'm set up, and after a successful login, I'm making the $auth->setExpire(30*60) call to set up for expiration after 30 minutes. But I left the web site last night, and this morning went back, and it was still active, so it didn't ask for a password. I also set the setIdle to 10*60 to set for 10 minutes IDLE time. Is there something I'm missing? Also - is there a way to modify the SQL the Auth program uses to look for an "enabled" flag? As currently implemented, if the username/password exists, the user can login. I need an additional flag for whether they have paid or not. Am I best off writing my own Auth, or subclassing, or something? Suggestions welcome. Thanks. -Scott