api: lower maximum lifetime of api sessions
reimplement remember_me