Expired authentication credentials persist in Remix cookie sessions

The goal is to diagnose whether Remix automatically invalidates expired credentials within cookie-based sessions, or whether the application must enforce expiration in every loader and action.

Remix supports cookie-based sessions with configurable lifetimes, but it is unclear whether the framework rejects a credential after it expires or only after the cookie itself expires. Session expiration logic may require application-layer implementation, and session handling APIs differ between Remix 1.x and 2.x. The precise boundary between cookie lifetime and credential lifetime needs confirmation before designing least-privilege authentication.

Specific questions:

• Does Remix invalidate a session when the underlying credential expires, or only when the cookie expires?
• Which session configuration options control credential lifetime versus cookie lifetime in Remix 1.x and 2.x?
• Where in the request lifecycle should expired credential checks occur to avoid duplicating validation across loaders and actions?