Allow the various payload expiries to be overridden by config.

Some infosec requirements have strict cookie expiry policies. This feature allows those cookie expiries to be overridden in config.