On security and session expiration