But aren't cookies an HTTP think, not a WS thing?