set expire in cookie value

ensure every session will expire.

there is a security risk if anybody hack other people's cookie, and this cookie will never expire.
oh got it. i thought that was there before.