Auth token cookie does not have an expiration

[mgwalker]

When the API creates and sets the auth token cookie, it does not set an expiration. The result is that the browser creates a "session cookie," which causes it to be deleted when the browser is closed. (Session cookies can be deleted prior to the browser being closed as well; the exact circumstances are kind of unpredictable based on the browser, but closing the browser will always do it.) The result is that users can be logged out by closing their browser, rebooting their computer, etc.

One question is whether this is the desired behavior. I don't have a strong opinion either way. There's a security argument in favor of session cookies, but there's a convenience/usability argument for longer-lasting cookies.

This task is done when either...

• closed because it works as expected OR
• the cookie has an appropriate expiration set