no maxAge to have a browser based session