fix(session): correctly sets cookie params for sessions