return undef from invalid sessions not empty hashref
document cookie protocol
clarify max_duration attribute