absolute auth timeout

Fixes #4317
So the problem is that there are two cookie collections: Request's and Response's.
Logout does not remove the cookie from Request's CookieCollection (which is readonly anyway). It just adds a cookie with '' value and 1 expiration to the Response cookies (so the browser will delete the cookie). But loginByCookie will just read the cookie from Request's CookieCollection, which still has the identity cookie that the browser sent us.