OPAC redirects users without warning or opportunity to cancel

Confirmed in Evergreen 3.9.1
Google Chrome 109.0.5414.120

We are working on increasing the accessibility of Evergreen for our patrons, and we hit an error on the myopac pages with regard to page refreshes and redirects. We are using the WAVE browser extension to detect accessibility issues in the pages.

This is the error that we received when loading up any of the MyOpac pages:

The page is set to automatically change location or refresh using a <meta> tag.

Pages that automatically change location or refresh pose significant usability issues, particularly for screen reader and keyboard users.

How to Fix It
Remove the <meta> refresh and give the user control over time-sensitive content changes.

Steps to replicate:
Go to the OPAC home page.
Log in as a user
Use the wave extension to diagnose the page for accessibility issues.

The meta tag that is causing this issue is located at the top of the templates_bootstrap/opac/parts/base.tt2 template file:

<meta http-equiv="refresh" content="[% ctx.authtime %]; url=[% ctx.home_page %]" />

To rephrase what is happening here: logged-in users are redirected away from the page they're viewing after five minutes, whether or not they are interacting with elements on the page. The privacy timeout uses the blunt-force <meta> refresh mechanism, does not update the expiration time based on any event listeners, and does not offer the user an option to cancel the redirect and extend their time.

This is a dire accessibility problem for people whose assistive technology makes reading and interacting with a page very slow. See WCAG criteria 2.2.1 Timing Adjustable (Level A): https://www.w3.org/WAI/WCAG21/Understanding/timing-adjustable.html

We should do all of the following, or something functionally equivalent:

1. Add a timeout warning dialog, as in this example: https://accessibility.huit.harvard.edu/give-users-control-over-timeouts

2. Reset the time based on virtually any browser event (scroll, focus, change, blur, any keyboard or pointer event)

3. Clearly state the timeout duration, perhaps on the login screen