implemented user session expiration