set session expiration to 1 week