Only ask users to log in once a year

As a default, set the expiration date of a cookie to one year in the future so users don't have to repeatedly log in.