fixed session expiry middleware