very basic cookie security