#946 CSRF cookie enhancements