More info regarding the call to `/api/whoami`:

From the Firefox dev console:

```
Request URL: 	http://127.0.0.1:10005/api/whoami
Request Method: 	GET
Status Code: 	HTTP/1.1 200 OK
Request Headers 16:56:14.000
X-Requested-With:	XMLHttpRequest
User-Agent:	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:27.0) Gecko/20100101 Firefox/27.0
Referer:	http://127.0.0.1:10005/provision.html
Host:	127.0.0.1:10005
DNT:	1
Connection:	keep-alive
Accept-Language:	en,de;q=0.8,es;q=0.6,en-gb;q=0.4,chrome://global/locale/intl.properties;q=0.2
Accept-Encoding:	gzip, deflate
Accept:	*/*
Sent Cookie
can_set_cookies:	1
Response Headers Δ1ms
X-Powered-By:	Express
Date:	Wed, 16 Oct 2013 15:56:14 GMT
Content-Type:	application/json; charset=utf-8
Content-Length:	4
Connection:	keep-alive
Cache-Control:	no-store, max-age=0
Response Body Δ0ms
null
```

It looks like the only cookie that was sent was `can_set_cookies`.

Going back a bit further to the call to `/api/login`, it looks like no cookies are sent:

```

Request URL: 	http://127.0.0.1:10005/api/login?user=shane
Request Method: 	GET
Status Code: 	HTTP/1.1 200 OK
Request Headers 16:56:12.000
X-Requested-With:	XMLHttpRequest
User-Agent:	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:27.0) Gecko/20100101 Firefox/27.0
Referer:	http://127.0.0.1:10005/sign_in.html?email=shane%40example.domain
Host:	127.0.0.1:10005
DNT:	1
Connection:	keep-alive
Accept-Language:	en,de;q=0.8,es;q=0.6,en-gb;q=0.4,chrome://global/locale/intl.properties;q=0.2
Accept-Encoding:	gzip, deflate
Accept:	*/*
Sent Cookie
can_set_cookies:	1
Response Headers Δ1ms
X-Powered-By:	Express
Date:	Wed, 16 Oct 2013 15:56:12 GMT
Content-Type:	application/json; charset=utf-8
Content-Length:	4
Connection:	keep-alive
Cache-Control:	no-store, max-age=0
Response Body Δ0ms
null
```