Matching expiries

This change takes the duration inside the encrypted blob and uses it to set a similar HTTP expiry on the cookie instead of using an ephemeral session cookie that doesn't expire until the browser is closed.

While the current implementation is not a problem from a security point of view because all that matters is the duration deep inside the cookie, it does mean that we leave invalid cookies lying around. This change reconciles the two expiry dates.

Next, I am planning to add a separate option to let sites specify that the session cookie should be ephemeral (i.e. no expiry on the outside of the cookie).