WCF: Be careful with allowCookies="true"