make sessions last 4 days by default
pass x-forwarded-for headers to origin