this is a scary thing to set in a super cookie. having apps check with the login API whether the user has admin rights sounds safer.