added web.xml to change session timeout