Well, with client-sessions, it's all just one cookie, now with two properties. And I `req.session.reset()` in `/provision/certify`, so the cookie will only last that long anyways.