Sessions should use max-age