don't use Host header for cookie value.