Clarify timeout vs cookieTimeout

As best I can tell from the source, at least.