handle session timeout correct