Session timeout work out fine. Message now implemented in the class. Minor bugs fixed.
Using sha1 and salt for password
Using sha1 and salt for password