make the spec clearer on the fact that each request will reset the timeout-timer for the session