afb-session: rewrite of cookie handling