before the primary takes control.

The primary will wait until the backup has replied with it all the way
done shutting down before it takes over.  Before it would just wait 2
seconds which probably was ok in most situations.  Now we don't return
until it is completely out.

This also ups the CONTROL_TIMEOUT from 10 -> 30 seconds.