session handling hardening: explicilty set httpOnly, cookie maxAge matches session duration (1 day)