This when will always succeed now, because cookie-spec-factory is a function. Did you mean `(when cookie-policy ...)` here?