code: function() {
    var app = this;
    var config = app.config;
    var cookiesecret = config.cookie_secret;
    if (!cookiesecret) {
      cookiesecret = crypto.randomBytes(64).toString('base64');
      log.warn('no cookie_secret set in config/app.js, randomly choosing %s', cookiesecret);
    }
    app.use(cookieParser(cookiesecret));
    var sessionconfig = {
      secret: cookiesecret,
      resave: false,
      saveUninitialized: false,
    //the rolling feature doesn't impact how long session live on the server-side
    //but it does update the expire time on the session cookie
    //and as a side effect forces the session cookie to be set every request
    //without this the cookie for existing sessions will not be sent if it doesn't have an expires
    //but we need it to be in the case where we downgrade a persistent session to browser-session one
    //when the user logs in again without "rememberme" checked
    //(search for "debug('already set browser-session cookie');" in express-session)
      rolling: !!config.persistentSessionSeconds,
    };
    if (config.sessionfactory) {
      config.sessionfactory(sessionconfig, app, session);
    } else {
      // /es5 needed for node 0.10 and 0.12 compatibility
      var MongoStore = require('connect-mongo/es5')(session);
      sessionconfig.store = new MongoStore({
            url: config.dburl,
            //would be nice to save session natively but that fails if keys have '.' or '$'
            //stringify: false,
            //the session ttl if session.cookie.expires isn't set:
            ttl: config.browsersessionSessionSeconds
      });
    }
    //the session middleware works as follows:
    //if no req.session is set read sessionid out of session cookie and load the session
    //if session cookie isn't present generates a new session
    //at the end of the request the session is stored if modified and set-cookie header is sent
  
    //XXX express-session deprecated undefined resave option; provide resave option
    //express-session deprecated undefined saveUninitialized option; provide saveUninitialized option
  
    app.use(session(sessionconfig));
  }
docs: /*
  Configures cookie parsing and session middleware