It might be nice to not set this if it came from the session to avoid sending another cookie in the headers. Not a big deal I don't think.