make sure tracking cookie is enforced for login handler.

apiV1login.go

@@ -69,7 +69,9 @@ func apiV1Login(w http.ResponseWriter, r *http.Request, ss *loan.Session) {
 	res.add("buser", ss.User)
 	res.add("bpass", ss.CheckSum())
 	res.add("mid", ss.Get("mid"))
+
 	//send out
+	apiV1AddTrackingCookie(w, r, ss)
 	res.sendJson(w)
 }
 

apiv1.go

@@ -109,7 +109,6 @@ func apiV1AddTrackingCookie(w http.ResponseWriter, r *http.Request, session *loa
 	mid := apiV1GetMachineId(r)
 	cookie = http.Cookie{Name: "mid", Value: mid, Expires: expiration}
 	http.SetCookie(w, &cookie)
-
 }
 
 func apiV1InitSessionByHttpHeader(r *http.Request, ss *loan.Session) (e error) {