cookie expiration defaults to 1 year