private Cookie createDefaultCookie() {
        Cookie cookie = new SimpleCookie(DEFAULT_REMEMBER_ME_COOKIE_NAME);
        cookie.setHttpOnly(true);
        //One year should be long enough - most sites won't object to requiring a user to log in if they haven't visited
        //in a year:
        cookie.setMaxAge(Cookie.ONE_YEAR);
        return cookie;
    }
Removes the rememberMe cookie from the given request/response pair.

@param request  the incoming HTTP servlet request
@param response the outgoing HTTP servlet response
web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java