Short session expiration does not help security | Hacker News