Fixed #35: made defaults for express-session explicit