Added check for cookie expiration at DB level

[inglemr]

This change prevents the user from being able to bypass 2FA by changing the expiration of the cookie manually by adding a timestamp for cookie expiration.

One potential issue is if the configuration option for cookie expiration is changed it won't take effect until the next time 2FA is requested for that specific user.