because of invalid chars cookies we need to use our own cookie management