session timeout set to 1 hour