implementing /session/:sessionId/timeouts