You're just guessing about cookies. You need to debug it. Do it in a browser where it works and look at the headers you get back. Then compare them to the headers you get back from Mech requests.