redirect loop unless it can set a cookie in the client. Reported by: pointyhat (via erwin) Feature safe: yes