Cookies should last longer than a single session.
We expire session tokens on the server after a month, but the client cookie will last a year
and then just be replaced when we re-authenticate.