does safari leak ssl-only cookies?