#260 handle session timeout