Somewhat unrelated: shouldn't we remove the original cookie when we add the secure one? It's not obvious to me that `chrome.cookies.set` will recognize the pre-secure cookie and the secured cookie as equivalent.