handshake API

because the default is a Session cookie, this overrides to one year.