session and cookie life time moved to attrs