properly assign session cookie maxAge
fixes #30