fix minor bugs and add 4h cookie timelimit on logged session