session secured · auto-expires after 4h idle