Non-inf cookies weren't being set correctly on IE, we believe because of the combination of HTTP/1.0 and max-age. According to RFC 2109, max-age should be used for HTTP/1.1 while Expires is appropriate for HTTP/1.0. We've simply added Expires to every cookie, and set it equal to the current time plus max-age.