* fail makeCookie if the app id hasn't been registered
* do static initialization
* fail if duplicate app id registration

still not a perfect framework but better than before