Per Tornado's documentation:

By default, Tornado’s secure cookies expire after 30 days.
To change this, use the expires_days keyword argument to
set_secure_cookie and the max_age_days argument to get_secure_cookie.
These two values are passed separately so that you may
e.g. have a cookie that is valid for 30 days for most purposes,
but for certain sensitive actions
(such as changing billing information)
you use a smaller max_age_days when reading the cookie.

With the current implementation inauth/login.py,
this is possible to pass theexpires_days option
but not possible to enforce it as this is not possible
to passmax_age_days toget_secure_cookie

This makes impossible to set the cookie expiration without
using a customLoginHandler.

This revision is about adding the possibility to pass options
to Tornado'sget_secure_cookie method,
so it can be possible to set the cookies expiration,
among others.

In my opinion,get_cookie_options is a weird naming given the options to pass toset_secure_cookie are calledcookie_options. That said, I am not sure what is your policy regarding the retro-compatibility of the settings, ifcookie_options can be renamedset_cookie_options or not. Anyway we first have to discuss the feasibility of this change.