session timeout default to 2.hour