modify authcontroller and expire session on close