[j_s]

Implement cookie expiration server-side.

[jessaustin]

Would anyone be tempted to do this "client-side"? What would that even mean, besides what the browser does automatically? Or are we just saying, "don't trust that the client won't send expired cookies"?