fix(client): set cookies.txt readable only by owner

Includes integration tests for client behavior.

Fixes #1611.
Could we add a "should be" as well so we can quickly compare and contrast the differences?