fix(client): set cookies.txt readable only by current user

Includes integration tests for client behavior.

Fixes #1611.