A seperate header is used instead of relying only on current cookie
because the current cookie is difficult to modify before being
forwarded, and would make removing invalid cookies in responses
complicated.