Cookie Max-Age is in seconds, not msec

closes #614