session expiration tested