Cookie logic depends on the request-uri
Compare cookie domain with request host
Use request host if domain-attribute is empty
Use request path if path-atribute is empty
HttpOnly can only be set from http(s) APIs
Ensure duplicate attributes are handled correctly