httpd: drop Max-Age from the session cookie

The server timeout is an inactivity timeout: scan_header() refreshes
last_session_use on every authenticated request. Max-Age counts from
login instead, and the cookie is only set there, so the browser deletes
it session_timeout seconds after logging in however busy the session
is. Leave expiry to the server, which already handles it.

The five-digit itoa16_html() stays: information.json must print
timeouts from 10000 to 65535 correctly.

httpd/httpd.c

@@ -690,8 +690,6 @@ static void run_login_body(__xdata uint8_t *body)
 				      "Set-Cookie: session=");
 		for (uint8_t i = 0; i < SESSION_ID_LENGTH; i++)
 			outbuf[slen++] = session_id[i];
-		slen += strtox(outbuf + slen, "; Max-Age=");
-		itoa16_html(session_timeout);
 		slen += strtox(outbuf + slen, "; SameSite=Strict\r\n\r\n");
 	} else {
 		dbg_string("Password invalid!\n");