> We do not set any cookies on redirects but do use cookies for authentication for users

You also set cookies on every request apparently. What are they for?

    $ curl -Is https://t.ly/ | grep -ic set-cookie
    3