fix bug in handling of files exempt from throttling
remove unused code for baking http header
fix bug in login cookie code, expiry should be +1d, not 1d