Note that the law only requires this banners for cookies which e.g. track you. (Which by now require far more opt in than a cookie banner, thanks to GDPR).

For purly functional cookies like they are used for CSRF prevention or login cookies do not require any user notifications as far as I know.

(Be aware that this is only true for login cookies which are just used to handle a active login, which means they must set the right flags to not be send to a different domain, etc.)