HTTP-only session cookie · 30-day session · TLS encrypted