added exercise to cookies

I worry that this example setup might mislead people with less experience into thinking that they are learning how to do a proper login. Maybe we could change `/login` to `/set-cookie`.