Support delegated auth cookies with : characters

The string:tokens function silently drops any empty token,
thus giving a spurious failure for valid input. The fix changes this
mechanism to one that losslessly decodes this part.

c.f COUCHDB-1607

BugzID: 25223