set expire in cookie value

ensure every session will expire.

there is a security risk if anybody hack other people's cookie, and this cookie will never expire.
don't affect performance in my test