added session.timeout configuration setting