I think this is probably fine, but I am personally curious why Play! goes through such lengths to verify that the expiration time is respected.  It sets the timestamp in the session, signs it, and uses that to verify it, so that a malicious client can't use the cookie after expiration.  I'm not sure if there is a use case that we should concern ourself with..  Thoughts?