fix for arbitrary ordering of cookies from http