implement session expiration, one hour by default, closes #24