session: remove internal sources on timeout