The nature of this bug was two-fold:
1.) A new Date was being instantiated with seconds,
but the constructor expects milliseconds.
2.) The expiration period was not cast to a number,
causing an expression to concatenate strings instead of
adding numeric values; this greatly increased the actual
expiration date.