Stricter cookie validation regexp.

Cookies are user input, and users are evil :)