implemented proper session timeout