based on the discussion in #23835, I file here that the function setcookie() should include the missing paramenter 'max-age'.

max-age is defined in:
http://www.ietf.org/rfc/rfc2109.txt
http://www.ietf.org/rfc/rfc2965.txt 
which both are referenced in the documentation of the setcookie() - func itself.

max-age has become more and more important, because it removes the timezone-issue from the former way of timestamping cookie expiration dates.


thanks for considering. 

-----

here's some detail taken from the rfc-specs:


Max-Age=value

  OPTIONAL.  The value of the Max-Age attribute is delta-seconds, the lifetime of the cookie in seconds, a decimal non-negative integer.  To handle cached cookies correctly, a client SHOULD calculate the age of the cookie according to the age calculation rules in the HTTP/1.1 specification [RFC2616].  When the age is greater than delta-seconds seconds, the client SHOULD discard the       cookie.  A value of zero means the cookie SHOULD be discarded immediately.