making session expiration configurable
updating config