Use ApplicationCookie options in more places

- Remove ClaimsIdentity.AuthenticationType now that
ApplicationCookie.AuthenticationType is available
- Also set Expires on a cookies that need them