setting expires session attr on login