I found 12 difference instances where we create the CGISESSID cookie, and each one has its own invocation that needs to be updated when you want to change that cookie. It would be better if we wrapped the cookie creation in a function.
When we do this, it'll also be easier to sign that cookie with a crypto key...