session expires after 10 days from last request