Where the payload lives. Omitted (default) keeps it in the cookie itself, which needs no infrastructure. Set to 'memory', 'cache', or a custom ISessionStore to keep only an opaque id in the cookie and the payload server-side, which makes immediate revocation possible.