sess_selfservice cookie is persistent

[phavekes]

This issue is imported from pivotal - Originaly created at Apr 25, 2024 by Pieter van der Meulen

In SelfService 5.0.4-beta2 the sess_selfservice session cookie is persistent with a timeout of 24h. However It must be a session cookie so that when the uses closes the browser the cookie is destroyed. The relative and absolute session limits must be enforced by the app, these cannot be set on the cookie as a parameter.