cookies now contain random bytes