now we could set the cookie expiry to be larger than the access token