updated session expiration handling