The browserid expiration is for auth time only.

This is how long we should consider this information while actually
negotiating authentication.  We can keep the stuff around as long as
we'd like.