Set expiration time for `assertion` cookie

This is mainly cosmetic. The cookie already contains a signed
expiration date, but this change prevents a useless cookie from
continuing to exist on users' computers.