allow setting session timeout via environment variable