Thanks. I noticed that too for the change in 2017.
This private app didn’t have explicit code to clear any cookies before the next API request, so I wasn’t certain if it was possibly sending a cookie it received from the Shopify API, or not.
It has the code now to clear out any cookies before each request in the mean time, which hopefully is fine until this app can be rebuilt.