Doesn't this lead to the following property:

<base64_data>--<expires_int>--<hmac>
==
<base64_data><expires_int>--<hmac>

Wouldn't both of these values result in the same value for generate_digest?

Then, the comparison done above on line 53 would fall through (all of the validations would pass), and would then depend on the base64 decode and/or the serializer to fail.  If these didn't fail, then this value would be accepted and time validation would NOT be performed (since the submitted value only contained a single "--" delimiter).  Thus, if the moons aligned (fairly unlikely I acknowledge), a perishable cookie could be submitted as a permanent cookie.  While unlikely to be exploited, it seems incorrect for the integrity/identification of a perishable cookie to depend on failure during base64 decode and/or deserialization.