allow session timeout to be supressed via an environment variable