Allow configuring cookie expiration in CookieHttpSessionStrategy

[rwinch]

While a secure default is important (i.e. having a cookie expire when browser is closed), some applications may want to customize this. We should allow customizing the cookie expiration.

Relates to #112

[rwinch]

I'm trying to aggregate all the feature requests for cookies, so we can solve this problem more holistically. Therefore, I'm closing this in favor of #299 which takes this feature into account.