add session timeout (24 hours)