add support for InvalidCredentialsError
make generate_cookie emit both max-age and expires when max_age is specified.