test: add another session duration test

We test that the session is cleared after it expires, but we don't
check that it's still there just before it expires, at least not in
the same way.
Always set the HTTP expiry on the cookie to match internal duration

The external expiry on the cookie (which is really just a suggestion
for the browser) should be the same as the expiry inside the
encrypted/signed payload. That way the browser will avoid sending
an invalid cookie to the server.

https://github.com/mozilla/browserid/issues/2754
test: remove lies in comments

Perhaps the internal duration was 400 ms in a former life, but
now it's set to 500.