The cookie lifetime is set in minutes in the Control Panel (as the page states for the input box); the hardcoded value of 2592000 seconds (in the code) is a real world maximum of 30 days, we advise against values of infinity.
Asking users to revalidate that they are the account owner every 30 days by being forced to login to their account is far from unreasonable, and adds a layer of security to your forums... Its not like we're forcing them to update their passwords.
