no maxAge to have a browser based session

use non expiring token
Merge pull request #3 from locojay/master

browser based cookie session