Goodpoint, I might end up moving the cookie management into a separate object to keep the client simple, and make it easier to write tests for these kind of situations.