`set_cookie` should expire cookie when token expires

[rwestergren]

    def set_cookie(self, response: Response, token: str) -> None:
        payload = self._get_payload(token)
        expiration = datetime.fromtimestamp(payload.get("exp"), tz=timezone.utc)

        response.set_cookie(
            key=self.cookie_name,
            value=token,
            httponly=True,
            samesite="lax",
            expires=expiration,
            path="/",
        )

[kigawas]

I think it's better to add kwargs to the function instead of setting the expiration

[rwestergren]

That's fine but not sure why you would want an expired JWT stuck in your cookie store. You also cannot easily access the token expiration since _get_payload is private - you will want the expirations to match in most cases.