Remote login page needs to know which site request came from.

I used [HTTP::uri] because that's the requested page rather than relying on the browser to have a correct referer header. If you aren't seeing a value for $req_uri in your HTTP_REQUEST event, it's because the header didn't exist on that request. As far as the cookie being added, you're not seeing the log event from HTTP_RESPONSE at all?