Interesting... Care to explain the concepts behind your loginless auth? In a sentence or two? Thanks! (do not have time to go through code myself :( )
The user also has a private url which he can use to login using other devices. Once logged in from this unidentified device, another cookie is created for the user but with a short time span. The user has the option to set the device as trusted which will result in the cookie expiry to be set at 15 years.
You probably ask for user's email and send them their secret special link that could be used over and over to restore the cookie? in case if they accidently delete their cookie?