No escape cookie name

This fixes a vulnerability: see https://github.com/github/github/issues/9958 https://github.com/github/github/issues/9960

/cc @github/security @github/rails