> and expiring it when you log-out?
and how would you do that if the user doesn't actively log out of a service?
and how would you do that if the user doesn't actively log out of a service?
specifics depend upon the language and framework used on the server, etc...