session expiration time should be based on session.gc_maxlifetime value (or session.cookie_lifetime if one is larger)