I don't think we can do this universally -- each cookie has a different lifespan. The "it's OK to certify this user" cookie needs to be Rather Short. The "here's what the user claimed" cookie needs to be Rather Long-lived, since we have to wait for them to go aaaaall the way through Google's OpenID flow.