removed return-href cookie