Harden cookie login plugin (Fix #2413)