anchor.diff:  make_cookie_time() ->
       {NowMS, NowS, _} = erlang:now(),
       NowMS * 1000000 + NowS.
  +
  +cookie_scheme(#httpd{mochi_req=MochiReq}) ->
  +    case MochiReq:get(scheme) of
  +        http -> {http_only, true};
  +        https -> {secure, true}
  +    end.
  
positive.code:     end.
  
  cookie_auth_header(#httpd{user_ctx=#user_ctx{name=null}}, _Headers) -> [];
  cookie_auth_header(#httpd{user_ctx=#user_ctx{name=User}, auth={Secret, true}}, Headers) ->
      % Note: we only set the AuthSession cookie if:
      %  * a valid AuthSession cookie has been received
      %  * we are outside a 10% timeout window
  
negative.code:                 ]});
          _Else ->
              % clear the session
              Cookie = mochiweb_cookies:cookie("AuthSession", "", [{path, "/"}, cookie_scheme(Req)]),
              send_json(Req, 401, [Cookie], {[{error, <<"unauthorized">>},{reason, <<"Name or password is incorrect.">>}]})
      end;
  % get user info
  