...oh, small bump by the way: I should mention that any code attempting to grab a cookie being ran in preview won't actually work - you'd need to deploy it to the site itself in order to test it. Otherwise, there's no cookie to grab, because the preview is running on Construct's website and not your own.
I suppose for testing purposes you could try implementing the login form within construct and store the token as a cookie or in session data, then try to grab it using a different script, but you'd need to configure CORS on your webserver for that to be possible.
It's tricky, and I'm sure what we're doing here was never intended by the developers of construct; this wouldn't work at all on a mobile deployment, only HTML5.