The document.cookie API has to be the worst API ever invented. I'd fix that and resolve the differences between JS and HTTP cookies.