reduce default session expiration limit
implement some tweaks to session handling; properly remove session cookie if invalid/login failed