change CookieSessions to only last for Session timeout