You are right!
The server's time and my local differ. But only ~40 seconds. I hope that is the problem, because now the cookie is set when I try -expires => "+30s" but is not thrown away after this time :(. I am thinking about getting away from cookies, too. Many people have told me great advantages of other session-time verfication.
There is just one point I do not understand (It's silly perhaps): A server in America with 6 hours difference for example (I am from Germany) will give me correct cookie (-times), right? Then how does the server do it?

Thanks for your suggestions :)

BioHazard

---

reading between the lines is my real pleasure