for now, default to real (non-permanent) session cookies that are cleared at browser close

SESSION_EXPIRE_AT_BROWSER_CLOSE = True

later we can maybe have a "remember me" checkbox at login time, so a user can decide on his
own whether to use session or long-living cookie.