set cookie only if there is something to store
fix session test for new cookie handling
Merge branch 'login-cookie-only'