A.7.2.4 Cookie handling fixes

  1. A Cookie path bug was noticed when Albatross applications were used with the Safari browser. absolute_base_url() was generating a trailing slash on the returned application URL (so /path/app.cgi/ instead of /path/app.cgi). This was causing problems for requests like /path/app.cgi?blah in that Safari did not send the cookie (probably correctly).

  2. When an application was accessed via https, the secure attribute on any resulting cookies was not being set. This attribute marks the cookie to be only returned via an https connection. The secure attribute is now set.

  3. Cookie max-age was being allowed to default - this is now explicitly set to match the configured session age (from the Application session_age parameter).