Allow the various payload expiries to be overridden by config.

Some infosec requirements have strict cookie expiry policies. This feature allows those cookie expiries to be overridden in config.
See above. Needs more defence.