enforce timeout on sessions

close issue #13