Add cookie expiration.
Refactor improper usages of conn and auth.