expire sessions sooner for unauthenticated requests