There seems to be a discrepancy in urlencoding.  

No decoding is done when breaking apart the cookie.  No encoding is done of the current cookie value when setting the cookie.