Third-party JS cookie work, reopened

Continuation of #3116, rebased against current dev to avoid orphaning existing branches.