cleanup bypass handling code
inline subroutine for character savings
make bypass cookie not restricted to https
set httponly flag on bypass cookie