fixed header / added session timeout