use maxAge if expires is missing
unlike HTTP cookie, maxAge in connect and express are in milliseconds
connect.session needs cookie maxAge specified to enable session expiration
bump