Added strip_tags() to cookie to avoid basic JS injection

Identified during pentesting.