bug 9401: remove direct reads of CGISESSID cookie by JavaScript