code: public void effectLogin (
          User user, int expires, HttpServletRequest req, HttpServletResponse rsp)
          throws PersistenceException
      {
          String authcode = _repository.registerSession(user, Math.max(expires, 1));
          Cookie acookie = new Cookie(_userAuthCookie, authcode);
          // strip the hostname from the server and use that as the domain unless configured not to
          if (!"false".equalsIgnoreCase(_config.getProperty("auth_cookie.strip_hostname"))) {
              CookieUtil.widenDomain(req, acookie);
          }
          acookie.setPath("/");
          acookie.setMaxAge((expires > 0) ? (expires*24*60*60) : -1);
          if (USERMGR_DEBUG) {
              log.info("Setting cookie " + acookie + ".");
          }
          rsp.addCookie(acookie);
      }
docs: If a user is already known to be authenticated for one reason or other, this method can be
  used to give them the appropriate authentication cookies to effect their login.
  
  @param expires the number of days in which to expire the session cookie, 0 means expire at
  the end of the browser session.