I was looking at the nightly and noticed long_expiration was changed to add *24 for one month. In the line above self.settings.expiration either the comment is wrong or the *24 should be applied there as well.
self.settings.expiration = 3600 # one day self.settings.long_expiration = 3600*30*24 # one month The manual example in the auth chapter says seconds so I suspect the comment is the problem. The long_expiration description in the book chapter on auth is missing the *24 Small details but helps with understanding. Really like working with web2py Ron