All tests so far pass (but currently using cookie-- we should prevent the cookie from being sent back and just store it in the socket handshake-- i.e. sorta like making normal cookies httpOnly)