moved setting session timeout header from view to controller