move cookie setting to client-side; good prog.