keep cookie values and session in sync
use static timeouts
the timeoutes aren't constants