use session expiration value as well.