added decode_cookie.rb
star UI must be in an iframe at a different subdomain so that the javascript can't just reach in and get the CSRF token