Third-party JS cookie work, reopened

Continuation of #3116, rebased against current dev to avoid orphaning existing branches.

A bit more context: I wasn't able to fast-forward rebase against current dev, and opted to cherry-pick the 4 commits rather than create a pretzel of dev -> topic branch -> dev merges.