Nit:  This comment is out of date.  If the cookie is an older version we update and return non-null.  But we do now return null if its corrupt.