Perhaps you can use CGI::Session, this will allow you to have a the who session expire, after which the cookie is ignored by your script.

It will also allow you to expire specific keys within the session after a given time like so:

$session->param ('fieldname' ) # retreive the data from the session
$session->expire ('fieldname', '+15m') # fieldname expires after 15 mi
+nutes
[download]

(this api is like the one CGI uses )