bugfix: cookies should be merged