expand default token validity to around 30 days
Rejected
Task
tokens are secure and stored in secure cookie, make them last long