Test cookie handling (and tampering)