I was doing some more 403 testing and it seems that sometimes (I think if you're logged in), removing GDSESS is not sufficient. You also need to remove PREF (we can imagine what that cookie controls. Doesn't log you out though). I wouldn't be opposed to _not_ removing this cookie and just let the user deal with it. It's hackish as it is.