Cookies sessions

As I have been discussing (by myself) in #2066

Here's some work to allow different timeouts to be set for the front-end and back-end. This needs more work before pulling in, and is here for point of discussion until I can completely overhaul the session handling for `2.5`.