By managing sessions, you can't control how long an authenticated and authorized user can access the resource.