fixed small issue when redirected after expired session
optionally disable session revalidation in cookie auth