Not setting the cookie timeout, it is better if the user can control this

Fixes #4239
That's a reasonable default imo.