letterboxd appears to now send multiple csrf set-cookie headers one of which is empty. this means that we are now required to check both of these to make sure we grab the correct one.