Fix MaxAge check.

[jmcarp]

Since MaxAge of 0 means cookies shouldn't be expired, only delete cookies with MaxAge < 0. Plus, update tests to verify that session files have been deleted or not, as appropriate.

[Resolves #96]

cc @adborden

[kisielk]

This seems like the right thing to do but I'm a bit concerned about the change in semantics. If people have been using the package and setting MaxAge to 0 to delete sessions, now these session will no longer be deleted. That could be a surprising / harmful change in behaviour.

@elithrar what do you think?

[elithrar]

https://godoc.org/github.com/gorilla/sessions?importers -> 661 importers. That's not going to show all the non-OSS repos out there that import us, but we could scan quickly to see how common MaxAge 0 vs. -1 is and understand the context in those cases.

(Otherwise, this change is API breaking and the side-effect - not deleting a session - is fairly severe)

[kisielk]

Now that there's some kind of versioning possible, maybe we should look at merging this?

[stale]

This issue has been automatically marked as stale because it hasn't seen a recent update. It'll be automatically closed in a few days.

[stale]

This issue has been automatically marked as stale because it hasn't seen a recent update. It'll be automatically closed in a few days.

[mengstr]

This is a really annoying limitation as most end-users expect a session to go away when he closes the browser tab (if not checked a "keep me logged in" box at the site). This especially on sites with a bit higher stakes of keeping a login lingering, like banking, healthcare and the likes.

Could this be fixed by use a "magical" value instead of 0 for producing a session cookie? Like 1 second (which would have no real use), or maybe -4242 seconds which no sane developer would use anyways.

Or maybe simply a new option like SessionCookie:true that overrides whatever the MaxAge is set to?

[jaitaiwan]

Even though a bot closed this out well before I became a maintainer I wanted to follow this up to say that in #271 I discuss the specific logic that's happening and from what I can tell this is expected behaviour. The fact that in some browsers the cookie stays around until the user closes the browser seems to me to be browser-specific behaviour and not spec-compliance.

If folks disagree, and they may well, we can talk about what possible changes should be made.

Further discussion should occur in #271.