To possibly add some context to this for automation...it would be good to have the session_id cookie to at least contain an expiration timestamp. I have an automation scenario where our automation engine, after initial authentication, continues to use this cookie to authenticate. Without an expiration it uses the cookie forever. In practice it only does this until it happens to use the cookie outside of the default timeout window after which it receives a 401 and invalidates the cookie. After that we can retry simple authentication. The downside is that we've had to make a workaround to where we explicitly watch for a 401 and then attempt reauthentication if we get that code. We shouldn't have to do this.