So this is buggier than I thought.

First, the hour normalization is still incorrect: there are 3600
seconds in an hour, not 360.

Second, the cookie expiration time is GMT, per the cookie spec. As is,
url-cookie-expired-p compares current time (no GMT adjustment) with a
GMT expiration time.

Please see the attached patch.

I fixed the hour normalization.

I added a function called url-cookie-gmt-time-string that returns the
current time adjusted to GMT. Please check this function. While I
believe my implementation is correct, there may be a better way to
adjust a time to GMT in Emacs.

I updated url-cookie-expire-p so that it compares local time as GMT
with the expiration time, also as GMT.

Thanks!
shawn