interesting that we actually set this on the session.  what is the lifetime of this session element?

only noted because the more sessions are used, the more `set-cookie` responses are sent - the more likely we have stomped sessions (very crappy bugs to try to isolate).