1. When you successfully auth via OpenID, we have to set a cookie so that the provisioning page knows it's OK to sign a cert for you. It just has to be valid long enough for you to transition from authentication page to provisioning page.

    The ok-to-certify cookie gets set on [server.js#L82-84](https://github.com/callahad/sideshow/blob/master/server.js#L82-84) and its expiration is checked on [server.js#L51](https://github.com/callahad/sideshow/blob/master/server.js#L43-57). The cookie is considered invalid if it was issued more than `ticketDuration` ms ago.

2. Sure, but I doubt this would ever be changed from the default outside of local testing, to be honest. Maybe we should focus on making sure the default is sane?

3. I :heart: camelCase, but happy to go with underscores if we want to buck broader JavaScript conventions ;)