HTTP(S) server-side cookie handling