Maybe avoid the magic number here by moving to config? Not sure what the 'company policy' is with respect to what goes into config.

If so, maybe add a "session" key, like:

    server: {
      session: {
        max_age: 24 * 60 * 60 * 1000,
      }
    },

However, that said -- Isn't there some kind of conflict or redundancy between this and the currently-specified max age of the cookie?  The cookie currently seems to be set to expire (via another hardcoded magic number) at 16 hours.

`server.use(express.cookieSession({ cookie: { maxAge: 60000000 }}));`