moved backend_app to specs
added test that specifies that cookies shouldn't be forwarded