Not setting the cookie timeout, it is better if the user can control this

Fixes #4239
Agree with @ADmad Admad, that's the best default. You can change that with more configuration