Website's session cookie expires in a year

This seems like quite a long time, I was expecting something around a few hours.

The issue names only the website's session cookie and does not identify a file, test, or entry point. Locate the website session-cookie configuration, confirm the current one-year expiry, and determine an appropriate few-hour expiry; done means the cookie no longer lasts a year and the relevant behavior is covered by an available check.

Written by the indexing model from the issue text.