Added tests to ensure that invalid tokens within cookies are rejected
Changed expires to re-authenticate rather than reject
Refactored to use cookies throughout