set anonymous cookie on startup
fix cookie -> httpOnly