When removing authentication cookies, the actual password shouldn't be sent again as the cookie value

Since all we're interested in is sending an expiration date in the past, the actual value is meaningless. For better security, better not send the password again as the cookie value.