Exactly what I was looking for, thanks. 90 days seems to ring a bell with what google is doing at the moment with microsoft, apple etc. Maybe not so much for (in this case) simply adding the http flag to your plain text user session cookie. But this is what I was looking for, best practices.

Again, thanks for the advice.