No longer need cookie-parser.
If we don’t specify a max age then it will default to null and will reset the session when the browser is closed.
https://github.com/expressjs/session
