Yes, that's possible, but what advantage would it get us?  I had previously implemented it, but then threw it away again.  One disadvantage of that is that it makes us rely on clocks being synchronized, which is an assumption we probably like to avoid here.

As of now, we unfortunately don't have any knowledge about the expiry time of a cookie here (there's only have the timestamp).  Choosing one minute seems like a good compromise to me, as it's unlikely that people will configuring a session timeout below that.  However, it might be good to consequently limit the session timeout to a minimum of one minute and document it appropriately.