cookie is sent on redirect