we should clean up `lib/default-config.js` based on the changegs to cookie requirements.