fix for the gimmick ..
make session timeout user-configurable value!