fixed session timeout and spec