Minimize cases where the access_token is still set, but invalid

src/routes/api/admin/tenant/+server.ts

@@ -97,7 +97,7 @@ export const POST: RequestHandler = async ({ request, locals, cookies }) => {
       secure: true,
       sameSite: "strict",
       path: "/",
-      maxAge: 60 * 60 * 24 * 7, // 7 days
+      maxAge: 60 * 15,
     });
 
     logger.info("Tenant switched successfully", {

src/routes/api/auth/login/+server.ts

@@ -279,7 +279,7 @@ export const POST: RequestHandler = async ({ request, cookies, getClientAddress,
       secure: true,
       sameSite: "strict",
       path: "/",
-      maxAge: 60 * 60 * 24 * 7, // 7 days
+      expires: sessionData.expiresAt,
     });
 
     logger.info("Login successful", {

src/routes/api/auth/refresh/+server.ts

@@ -102,7 +102,7 @@ export const POST: RequestHandler = async ({ cookies }) => {
       secure: true,
       sameSite: "strict",
       path: "/",
-      maxAge: 60 * 60 * 24 * 7, // 7 days
+      expires: result.expiresAt,
     });
 
     return json({