Description:
------------
I believe 7.x has the same issues, but I am using 5.6.x.

setcookie is setting a negative max-age value.  The RFC:

https://tools.ietf.org/html/rfc7234#section-5.2.2.8

states max-age is delta-seconds, which is defined in RFC:

https://tools.ietf.org/html/rfc7234#section-1.2.1

"The delta-seconds rule specifies a non-negative integer, representing time in seconds."

The test script below shows that the max age is getting set to negative values instead of zero.


In fixing this bug I noticed that it was also doing a time(NULL) instead of calling sapi_get_request_time().  I fixed that as well.


Test script:
---------------
<?php
setcookie("TestCookie-Now-3600", "1", time() - 3600);
setcookie("TestCookie-Now+3600", "1", time() + 3600);
?>

Expected result:
----------------
Set-Cookie: TestCookie-Now-3600=1; expires=Thu, 21-Apr-2016 19:29:15 GMT; Max-Age=0
Set-Cookie: TestCookie-Now+3600=1; expires=Thu, 21-Apr-2016 21:29:15 GMT; Max-Age=3600

Actual result:
--------------
Set-Cookie: TestCookie-Now-3600=1; expires=Thu, 21-Apr-2016 19:29:09 GMT; Max-Age=-3600
Set-Cookie: TestCookie-Now+3600=1; expires=Thu, 21-Apr-2016 21:29:09 GMT; Max-Age=3600