There cookies that where set by `repoze.who`, and stays in the environment after the work of `repoze.who`, so that the session middleware also loads them.

And this object are not in our domain of responsibility.