Is there currently anything wrong with my custom authentication and authorization?
I can't help with the security aspect of it because I don't know enough about it. So just same general code review things:


It seems odd that your CookieHelper class contains two methods which seem like they should be complementary operations however they are named inconsistently and their parameter/results don't really match up:


The MergeIntoString accepts a bunch of parameters which are all taken from some kind of user object.
The DecodeFromString splits up a string which was generated by MergeIntoString but returns a dictionary instead which you then seemingly have to parse back into a user.


I would suggest to rename the first method to UserToCookie and pass the user as single parameter returning a string and rename the second one to CookieToUser which accepts a string and returns a user object.

Alternatively keep the dictionary for the second method but then also pass in a dictionary in the first. You could then have helper methods which convert users to/from dictionaries.
You have some magic constants without a unit and therefore had to write a comment of what it means. 


   var timeout = model.RememberMe ? 525600 : 2880; // 365 days or 2 days



.NET has a TimeSpan type which is ideal to store this kind of information and it become obvious what unit it is and works nice with DateTime as well. So something along these lines:

var timeout = model.RememberMe ? TimeSpan.FromDays(365) : TimeSpan.FromDays(2);

....

    Expires = DateTime.Now + timeout,


Doesn't require a comment and it's immediately visible what the timeout could be.