fixed the cookie authentication with lua5.2

fixed the authentication issues with lua5.2 when set the tokenPersistence to 'cookie':
1. Set-Cookies missing with 302 redirect
2. refURL includes the token user string