code: function tokenToCookie(req, res, next) {
    if (req.signedCookies.authorization !== req.accessToken.id) {
      let opt = _cookieOpt(req, res);
      res.cookie('authorization', req.accessToken.id, opt);
    }
    next();
  }
docs: /* Access token live time prolongation
  @see: https://github.com/strongloop/loopback/issues/257
  function prolong(token, next) {
  var now = new Date(),
  createTS = token ? token.created.getTime() : 0,
  expiredTS = token ? token.ttl * 1000 : 0,
  dayTS = 24 * 60 * 60 * 1000;
  
  expired token
  if (createTS + expiredTS < now) return next();
  
  if (now.getTime() - createTS < dayTS) {
  create today
  return next();
  }
  update date created to now (extend expire date)
  token.updateAttribute('created', now, next);
  } /* although we don't rely much on cookies, we save last request auth in cookie
  in case they refresh page