> interesting that we actually set this on the session.

Where would you set them, instead of a secure cookie?

> what is the lifetime of this session element?

The session is reset during provisioning. Bigtent attempts to delegate session length to Persona certificates as well as Yahoo OpenID session length.