validating max session length