surprisingly, the session timeout is very hard