Did we "forget" the session timeout here previously? :-(