can't it be read in the cookie header?