tango: allow users to set the max age of the session cookie