Not 100% sure what we want to default expiration to. Right now I set it to +20years. The previous behavior (not specifying Expires:) in older browsers would kill the cookie at browser exit, which I don't think we wanted.