fixes #536 - CookieUtils now handles session fixation cookie