set expire in cookie value

ensure every session will expire.

there is a security risk if anybody hack other people's cookie, and this cookie will never expire.
`this.session.maxAge=` sets it across all routes? it should only change it per-request.