session expires in 2 hours as cookie does