When the JvmRouteValve resets the session cookie, it hard-codes max-age to -1.
It should use the max-age configured for the session cookie.

org.jboss.as.web.session.AbstractSessionManager#setNewSessionCookie

    // JBAS-6206. Configure cookie a la o.a.c.connector.Request.configureSessionCookie()
    cookie.setMaxAge(-1);
    ...

However Request.configureSessionCookie has instead:

    cookie.setMaxAge(context.getSessionCookie().getMaxAge());

It appears the code was copied long ago before max-age was added to the session cookie configuration, and not kept in sync.