set expire in cookie value

ensure every session will expire.

there is a security risk if anybody hack other people's cookie, and this cookie will never expire.
`this.sessionOptions` is independent in each request here.