now session expires after 10 minutes