Security Software

I am trying to understand how the global user inactivity timeout works.

1. Who sets the cookie OSSO_USER_CTX?

2. If at all , Who updates this cookie?

3. Is this cookie used to capture activity in any of the sso enabled applications?
What is the role of cookie domain?

4.when i look up cookie OSSO_USER_CTX in the browser (firefox) , it says that the cookie will expire at the end of session. Why does it not say that it will expire after some time based on what GUIT we have set?

5.Why should there be a dot in front of the domain e.g .oracle.com and not oracle.com?
We noticed that when running ssogito.sql, if we don't enter the cookie domain and hit enter, then GUIT acts as a session duration timeout.

Thanks in advance
Harish