session timeout working - ALSO regenerate against session fixiation