bug in session expiration