user should be redirected to login page after session timeout