I put the suggested line of code in the tutorial web config (p. 163). It shut down ability to log on. Is there more to do? Code is green because it is actually commented out in current web config.

<httpCookies domain="String" httpOnlyCookies="true" requireSSL="false"/>

The problem isn't with httpOnlyCookies, it's the domain="String" part. That sets the authentication to a non-existing domain named "String"

That was unclear, and will be removed in the next update of the book.

Try
<httpCookies httpOnlyCookies="true" requireSSL="false" />

Thank you, Mr. Galloway, it works.