new global flag: $allow_url_cookies
if url cookies allowed, we
- skip sending the cookie probe, ...
- startout with url cookie and, ...
- seamlessly switch to browser cookies if we find that they work
cosmetics
todo_on_submit no longer defined, do not use