no maxAge to have a browser based session

use non expiring token