Hmm.. It seems to me that the only situation where you'd refresh the expiration of the cookie would be the 3rd scenario -- that is, when the user is auto-logged in.

If they don't want their password saved, then they'll never be auto-logged in. If they log in and want their password saved, then their cookie is created normally anyway -- there's no existing cookie to refresh.

Anyway, I'm glad that you made the changes. 30 days is fair. If you set it to anything shorter, then semi-frequent (once a week or so) visitors might be discouraged from coming back since they find they have to always log back in.



Take care,

Nik
http://www.bigaction.org/