browser based cookie session

don't send MaxAge and leave the session alive as long as the browser is open.