Security provider not using the 'cookie options'

See this post for details