The value is small but definitely not zero. HTTP cookie allows session hijack, but HTTP login exposes your password.