I'm realizing that perhaps this is on purpose, since it doesn't make sense for cookies to be included in a request from the serverside.