absolute auth timeout

Fixes #4317
Why? If `logout()` is called, the autologin cookie will be deleted.

Have you tested this?