Letting session cookies expire on the client, updating cookie if `session.get()` finds a session, made message acknowledgement optional with a new parameter