independently manage a session object with browser cookies and timeouts