[name] asked: how does the token get into the cookie: does the frontend set it itself or does the server do it?