moved explicit session expiration to session_store