session-timeout set to 4h (for development - reset to 1h for production)