anchor.diff:      AuthSession = couch_util:get_value("AuthSession", Cookies),
       if AuthSession == undefined ->
           TimeStamp = make_cookie_time(),
  -        [cookie_auth_cookie(?b2l(User), Secret, TimeStamp)];
  +        [cookie_auth_cookie(Req, ?b2l(User), Secret, TimeStamp)];
       true ->
           []
       end;
   cookie_auth_header(_Req, _Headers) -> [].
   
  -cookie_auth_cookie(User, Secret, TimeStamp) ->
  +cookie_auth_cookie(Req, User, Secret, TimeStamp) ->
       SessionData = User ++ ":" ++ erlang:integer_to_list(TimeStamp, 16),
       Hash = crypto:sha_mac(Secret, SessionData),
       mochiweb_cookies:cookie("AuthSession",
           couch_util:encodeBase64Url(SessionData ++ ":" ++ ?b2l(Hash)),
  -        [{path, "/"}, {http_only, true}]). % TODO add {secure, true} when SSL is detected
  +        [{path, "/"}, cookie_scheme(Req)]).
   
   hash_password(Password, Salt) ->
       ?l2b(couch_util:to_hex(crypto:sha(<<Password/binary, Salt/binary>>))).
  
positive.code:             % setup the session cookie
              Secret = ?l2b(ensure_cookie_auth_secret()),
              CurrentTime = make_cookie_time(),
              Cookie = cookie_auth_cookie(?b2l(UserName), <<Secret/binary, UserSalt/binary>>, CurrentTime),
              % TODO document the "next" feature in Futon
              {Code, Headers} = case couch_httpd:qs_value(Req, "next", nil) of
                  nil ->
  
negative.code:                 ]});
          _Else ->
              % clear the session
              Cookie = mochiweb_cookies:cookie("AuthSession", "", [{path, "/"}, cookie_scheme(Req)]),
              send_json(Req, 401, [Cookie], {[{error, <<"unauthorized">>},{reason, <<"Name or password is incorrect.">>}]})
      end;
  % get user info
  