Remember-me token validity is hardcoded to Spring Security's 14-day default — expose it as configuration