updated session timeout and added InjectPrincipal filter