fix(client): set cookies.txt readable only by owner

Includes integration tests for client behavior.

Fixes #1611.