@Override
 public long issueNewSessionCookie(
     HttpServletRequest req, HttpServletResponse resp, String userId) {
   User user = UserManager.getUser(Long.parseLong(userId));
   long expiresAt = System.currentTimeMillis() + SessionUtil.SESSION_LIFETIME * 1000L;
   SessionInfo sessionInfo = new SessionInfo(user.getUid(), expiresAt, random.nextLong());
   FilterUtil.setSessionCookie(req, resp, sessionInfo);
   FilterUtil.setSessionInfoInRequestAttributeAfterLogin(req, user, sessionInfo);
   return SessionUtil.SESSION_LIFETIME;
 }
 @Override
 public void clearSessionCookie(HttpServletRequest req, HttpServletResponse resp) {
   FilterUtil.clearSessionCookie(req, resp);
 }