The location of a new session key returned by {sessionAuthorizationUrl}. Valid values are 'header' or 'cookie'.