limit length of session to not exceed length of user proxy