might be safer to use a constant for "cookie".