Should a `duration` be configured as well as `max-age`? See https://github.com/mozilla/browserid/pull/3980/files#diff-43bc087e8ce30c866ff58c56df77be13R352