So what's the plan here? Are we going to add a check for session_expires to the login code? Or are we going to move to a pure-cookie approach as @seanlinsley suggests at https://github.com/gittip/www.gittip.com/pull/2041#discussion_r10272149 ?