How about _.split("=", 2).  Although since this is a signed cookie which guarantees that we've produced it, we should probably still be defensive in decoding.