fixed session cookie timeout