default session lifetime is a day and secure cookie uses this value