something like as long as the cookie that's set indefinitely exists, the token can manage rotating themselves or something