refactor
user session in session cookie; disable/enable session ttl