b/util: added anonymous_cookie
b/api: session creation sets cookie