handle session expiry properly