some urldecoding also needed in the cookie setter