session cookie lifetime to 4h