session cookie lifetime
session cleanup function
randomly fire session cleanup