use expiry time in cookie instead of creation time