the bug was that it used a permanent cookie for not-logged in users and only switched it to
a session cookie when you logged in (and did not check the remember me checkbox).
now it uses (non-permanent) session cookies by default and switches to the permanent cookie
only if you tell so when logging in and checking that checkbox.