Box is adding configurable MFA timeouts