expire sessions after 48 hours and mask sensitive data if not local