absolute auth timeout

Fixes #4317
Yes, I have, the cookie removal doesn't work, because you're sending the same cookie back to the browser, except with an expiration of 1 second, in order to get the browser to remove it. So the identity cookie gets saved into CookieCollection's $_cookies, and when the code subsequently calls getValue, you will still get the identity cookie and the correct value from $_cookies.