I think as long as possible, without posing a security risk. You should make some rules and consistently improve upon them. Like start with @marvinpoo recommended idle time. Then you can add later on check for impossible behaviour like requesting two pages within microseconds, change of location within a browsing session(use this with grain of salt as mobile networks keep changing I.P), too many 404s.
I think you should also learn from big names like facebook and google. They take more than just time in consideration. They hardly ever log you out. When you are accessing something sensitive ask for password again, but not log them out. Only log them out after days of inactivity. You could refresh authentication token at every 24 hours with 30 days of expiry, and then ask for password again when they access something sensitive(of course with some validity period).