make EmbedGenerateCookie a callback, USER_IO can install their own or default to ours