bug in owin when using external cookies