check cookieName for separator

just because we're paranoid doesn't mean they're not out to get us