fix typo
use session expiry for cookie by default as well as config option