Use `expire_in` so that cookie will use session length
Use `expire_in` so that cookie will use session length

The Redis session store picks up either `expire_at` or `expire_in`.  So
the Redis TTL will be 90 minutes.

The Rack session cookie picks up `expire_after` which will be `nil` and
therefore set to the length of the browser session.

ausaccessfed/validator-service,ausaccessfed/validator-service,ausaccessfed/validator-service