code: func makeSessionCookie(c context.Context, sid string, secure bool) (*http.Cookie, error) {
  	tok, err := sessionCookieToken.Generate(c, nil, map[string]string{"sid": sid}, 0)
  	if err != nil {
  		return nil, err
  	}
  	// Make cookie expire a bit earlier, to avoid weird "bad token" errors if
  	// clocks are out of sync.
  	exp := sessionCookieToken.Expiration - 15*time.Minute
  	return &http.Cookie{
  		Name:     sessionCookieName,
  		Value:    tok,
  		Path:     "/",
  		Secure:   secure,
  		HttpOnly: true, // no access from Javascript
  		Expires:  clock.Now(c).Add(exp),
  		MaxAge:   int(exp / time.Second),
  	}, nil
  }
docs: // makeSessionCookie takes a session ID and makes a signed cookie that can be
  // put in a response.