tain-escape the cookie input

we only set the cookie if it is a proper <=32 char alphanum string.
Otherwise we just ignore the input.
Makes psalm also happier so that we can focus on other errors.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>