The long and the short of it: you need to reset the setExpirationSeconds method on every request if you want to have a sliding timeout.

I think a plugin is a way to go. No need to add code to every controller.