Added a cookie. This allows applications to use the Authorization header
for another type of authentication.