diff --git a/chfs-ng/internal/api/server.go b/chfs-ng/internal/api/server.go
index 6e0523b..502c665 100644
--- a/chfs-ng/internal/api/server.go
+++ b/chfs-ng/internal/api/server.go
@@ -425,7 +425,7 @@ func (s *Server) session(w http.ResponseWriter, r *http.Request) {
 		writeJSONError(w, http.StatusNotFound, "user or password is wrong")
 		return
 	}
-	token, err := auth.NewToken(a.Username)
+	token, err := auth.NewToken(a.Username, s.SessionTimeout)
 	if err != nil {
 		writeJSONError(w, http.StatusInternalServerError, "failed to create token")
 		return
@@ -1447,7 +1447,9 @@ func (f *webdavAuthFS) Copy(ctx context.Context, name, dest string, opts *webdav
 	return f.inner.Copy(ctx, name, dest, opts)
 }
 func (f *webdavAuthFS) Move(ctx context.Context, name, dest string, opts *webdav.MoveOptions) (bool, error) {
-	if err := f.allow(name, auth.Delete); err != nil {
+	// CHFS treats MOVE as a write operation on the source; W already
+	// includes read permission and does not require explicit delete permission.
+	if err := f.allow(name, auth.Write); err != nil {
 		return false, err
 	}
 	parent := path.Dir(webdavAuthPath(dest))
diff --git a/chfs-ng/internal/auth/auth.go b/chfs-ng/internal/auth/auth.go
index 4c7ea8b..f9897fe 100644
--- a/chfs-ng/internal/auth/auth.go
+++ b/chfs-ng/internal/auth/auth.go
@@ -186,8 +186,11 @@ type jwtClaims struct {
 	jwt.StandardClaims
 }
 
-func NewToken(username string) (string, error) {
-	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(365 * 24 * time.Hour).Unix()}}
+func NewToken(username string, timeoutMinutes int) (string, error) {
+	if timeoutMinutes <= 0 {
+		timeoutMinutes = 30
+	}
+	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(time.Duration(timeoutMinutes) * time.Minute).Unix()}}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	return token.SignedString([]byte(jwtSecret))
 }