CSRF 500 Error Bug

[eluser]Unknown[/eluser]
Yes, the server time is correct, but I had one visitor in particular that couldn't log in. After a lot of frustration, we found out his clock was a month fast.

I think it has to do with the CRSF cookie time out. Would it be bad if I set the cookie to timeout a bit longer?

Also, are time zones accounted for in timeout values?

Thanks.