max session length validation