New bad domains.
Moved session state out of the cookie.