- Only set the cookie if it doesn't exist
- Always mark it secure (it was previously getting re-sent as not)
-.Check the value against the header even if there was no value (so that
a request that is missing the cookie but should have had one fails).