set session expiration to 1 year