If the cookie is invalid, send an expired cookie value
Use apr_time_t instead of a pre-defined string
Address comments for changes and fix up tests