limit session age to one hour.