code: function createCookie(res) {
  		var salt = base64Random(saltSize);
  
  		var userData = getUserData(res.req);
  
  		var hasher = crypto.createHmac(options.algorithm, cookieKey);
  		hasher.update(salt);
  		hasher.update("|");	// Don't confuse longer or shorter userData's
  		hasher.update(userData);
  
  		var hash = hasher.digest('base64');
  
  		var cookie = salt + "|" + userData + "|" + hash;
  		res.cookie(cookieName(res.req), cookie, {
  			httpOnly: true,
  			secure: options.secure,
  			domain: cookieDomain(res.req)
  		});
  		return salt;
  	}
docs: The cookie has three parts: Random salt, userData (if any), and a hash of the previous two. If the caller provided a userData() function, the userData from the cookie will be checked against it during token verification Private function that adds a new cookie token to the response and returns its salt value