added tests
implement session expires