Hi I think there is an error in the http status codes that you respond with.
The log on succesful should return code 200
but the failure login should return 401
the server error should return 500
http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
not using the right return codes is annoying.
I have also used the set cookies again, for a new login and again it was annoying that the HttpOnly, is set incorrectly and in 2 different ways.
first with a comma and second without anything ( , or ; )
I think this is another error wich should be fixed.
These things would help people getting started programmering against the api.