Use Session type to create an empty session
Put cookie-formatting code in its own function
Make sure we have an expiration time in the cookie

Since we are adding the session expiration information to the cookie
just before building the cookie, we make sure that the Expires and the
information in the cookie match.

In this way we do not need to resort to gymnastics to put the session
expiration information in the session.