server: more robust cookie handling