Maybe I'm missing something here, but this line:
Session("user") = cStr(Request("username"))
Should probably be this:
Session("user") = cStr(Request.[QueryString||Form] "username"))
But to answer your question, the Session.Timeout value is changed by adding this:
Session.Timeout = ## where the ##'s are the number of minutes that the session will last.