* code review responses: moved more bStat identity cookie-related constants into the config file or instance vars
* also hook to set_auth_cookie action to set the bStat identity cookie when the user signs in