organize: cookie related code to cookie.go
simplify internal API by removing one indirection
Simplify type defs: use http.ResponseWriter