updates - correct processing of session expiry and redirect