Make cookies HTTP Only, should help protect a bit more against cross site scripting stuff..
Remove $path since it makes errors like a motherfucker