Include in the cookie payload the time it expires. And include that
in the HMAC so it can't be forged. So, normally, the cookie will just
expire anyways. But if someone steals/tampers with the cookie, it will
still end up invaildated after some time.