added configuration-attribute for session-timeout
added controller for session-management