[dev] session timeout question