default is session cookie, not one-year cookie