Front-end permissions

1) I think that's appropriate. This hacking with session cookies is really just a workaround for the fact that FEP does not have a formal 'log out' mechanism, and thus we need a way of forgetting access credentials that's slightly better than "wait two weeks". :-) However, if a site is using well-defined login sessions - as it is for users of wagtail admin - then it's reasonable, and I would say preferable, for those access credentials to be tied in to the lifetime of those sessions.

2) Dammit, you're right... I thought logins created a new session (and thus reset the cookie expiry to its standard Django setting). We could fiddle wagtailadmin's login to do that, but wagtail sites might be doing their own thing with sessions/logins (e.g. running a conventional Django site alongside a Wagtail instance) and it's not really fair for us to make them implement workarounds for our benefit...