issue #23, fixed spoof-able cookies, yeah!