use hours for mfa session validity