for those of you that care...
to get around this what I have done is just have the client code add in the cookie, and add in the value as a seperate request header, i.e.:
Code:
request.setRequestHeader("Cookie","aParam=aValue");
request.setRequestHeader("aParam","aValue");
and then on the server side, we check for the cookie first, if it's not there we look the for request header and use that.
It's a hack, and offends me, but hey, what can you do?