* models should not `setcookie`, move to controller
* cookie lifetime should be a configurable constant