net/http: do not send malformed cookie domain attribute

Malformed domain attributes are not sent in a Set-Cookie header.
Instead the domain attribute is dropped which turns the cookie
into a host-only cookie. This is much safer than dropping characters
from domain attribute.

Domain attributes with a leading dot '.' are still allowed, even
if discouraged by RFC 6265 section 4.1.1.


Fixes issue 6013

R=golang-dev, bradfitz
CC=golang-dev
https://codereview.appspot.com/12745043

Committer: Brad Fitzpatrick <bradfitz@golang.org>