Fix some validation; ensure HttpHeaders for auth
Properly handle returned cookie values (extract only ACTUAL value)