MDL-56129 core: Set a timeout on the session cookie