cookies being passed on in paranoid anon setting [2.2s5]

Hello!

I used to run squid 1.NOVM.20 with "http_anonymizer paranoid".
This setup worked very well. A few days ago, I upgraded to squid 2.2s5
using the recommended paranoid "anonymize_headers allow" commands
in squid.conf.

Visiting amazon.de, I discovered that I was not anonymous at all
because amazon greeted me by my name instead of the usual "If you are here
for the first time...".

Debug output shows that squid 2.2s5 indeed passes on the "Cookie:"
header even if configured to be paranoid about http headers.
squid 1.NOVM.20 didn´t do that.

Is this a (known) bug or have I overlooked some configuration option?

-Walter

-- 
  Walter Doerr   =*=   hikaru@infodn.rmi.de   =*=   FAX: +49 2421 962001
              "The poor folks who only have 100MBytes of RAM five years
from now may not be able to buffer a 16MB packet, but that's their
tough luck."              (John Gilmore on Mon, 10 Oct 88 18:10:21 PDT)