Moved from andling urls with Uri class to strings to support urls with invalid characters + added security on cookie