I'm not terribly wild about the session store being used for this. And why do we have the extra timeout thingie on top?