OK, that actually was a problem... due to some restructuring of where forum programs are, the new cookie had to be set at a lower directory level (/cgi-bin/) than it was before (/cgi-bin/mboard/). It was setting the new cookie fine under /cgi-bin/, but when it requested that cookie from the browser it was instead getting the old /cgi-bin/mboard/ one (for most cases).

One way past this would have been to get users to delete all of their cookies, but instead of that I've just given it a new name. So *going forward* cookies will work properly, and the timeout is currently 5 hours (was 6 hours originally).