refactoring:

- Response object should have a reference to Request object.
- fix session max-age settings.