diff --git a/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java b/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
index 2dabec23c..b7f82a077 100644
--- a/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
+++ b/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
@@ -1016,7 +1016,6 @@ public String setRememberToken( HttpServletRequest request, HttpServletResponse
 
 
     public String setRememberToken(HttpServletRequest request, HttpServletResponse response, int maxAge, String domain, String path){
-        String rval = "";
         User user = ESAPI.authenticator().getCurrentUser();
 
         try{
@@ -1039,13 +1038,11 @@ public String setRememberToken(HttpServletRequest request, HttpServletResponse r
             cookie.setSecure(forceSecureCookies);
             response.addCookie( cookie );
             logger.info(Logger.SECURITY_SUCCESS, "Enabled remember me token for " + user.getAccountName() );
+            return cryptToken;
         } catch( IntegrityException e){
             logger.warning(Logger.SECURITY_FAILURE, "Attempt to set remember me token failed for " + user.getAccountName(), e );
             return null;
         }
-
-
-        return rval;
     }
 
     /**
diff --git a/src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java b/src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java
index 2b164dbd9..015cc1d42 100644
--- a/src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java
+++ b/src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java
@@ -643,20 +643,23 @@ public void testSetRememberToken() throws Exception {
 
         int maxAge = ( 60 * 60 * 24 * 14 );
 
-        ESAPI.httpUtilities().setRememberToken( request, response, maxAge, "domain", "/" );
+        String token = ESAPI.httpUtilities().setRememberToken( request, response, maxAge, "domain", "/" );
 
         Field field = response.getClass().getDeclaredField("cookies");
         field.setAccessible(true);
         @SuppressWarnings("unchecked")
         List<Cookie> cookies = (List<Cookie>) field.get(response);
+        // The first cookie with this name is the one killCookie() adds, so keep the last one.
         Cookie cookie = null;
         for(Cookie c: cookies){
             if(c.getName().equals(HTTPUtilities.REMEMBER_TOKEN_COOKIE_NAME)){
                 cookie = c;
-                break;
             }
         }
         assertEquals(HTTPUtilities.REMEMBER_TOKEN_COOKIE_NAME, cookie.getName());
+        assertNotNull(token);
+        assertFalse(token.isEmpty());
+        assertEquals(cookie.getValue(), token);
     }
 
     public void testGetSessionAttribute() throws Exception {