default to a session cookie instead of setting an explicit timeout, weird timezone...