added exercise to cookies

Correspondingly, maybe `/profile` could instead be `/check-cookie`