handle session expiry properly
change to session id
introduce application state attributes