added session timeout setting