don't need to sent cookie header in response [at least for now]
fix localhost Ajax issue
fix first login duplicate cookie issue