handles user session timeout