v0.0.9 Fixed authentication cookies.

Have to set the path, sensible to set HttpOnly. The cookie
implementation is not ideal.