e6c0e2292b
Newer versions of jsonwebtoken reject undefined for expiresIn with "expiresIn should be a number of seconds or string representing a timespan". Omit the option entirely when no expiration is desired — cookie maxAge already controls session lifetime. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>