Users are logged out after the server session expires even if the "Remember Me" option is ticked on Tomcat 11

This seems to be caused by a change to cookie handling in Tomcat 11. Our cookie setting code encloses the value in quotes. These quotes are part of the value that is stored in the browser but so far, they were removed by Tomcat when parsing the cookies, so we got the value without quotes when reading the cookies in XWiki. This behavior changed in Tomcat 11:

Update Cookie parsing and handling to treat the quotes in a quoted cookie value as part of the value as required by RFC 6265 and explicitly clarified in RFC 6265bis. (markt)

We should check if we can use the proper APIs for adding cookies now (should be possible as we use a more recent Servlet version now) and thus could rely on the Servlet container to properly set the value without quotes. Alternatively, we could detect and remove the quotes.