finished cookies, no testing
implemented headers, no testing