session now sets validity on init