Remove unused require
Don't use HTTPOnly cookies if we're going to read them from JS
Fix login