set expire in cookie value

ensure every session will expire.

there is a security risk if anybody hack other people's cookie, and this cookie will never expire.
should delete every time?