Include iw.debug with the dev buildout
Make sure the form action goes to the actual protected object
Include a path and an expire to the cookie and use the full URL to redirect, instead of generating it again