Restrict cookies to same-origin

At the moment, cookie origins have to be handled by the Requests user, rather than by the library. This sucks.

Fixes #118, see #119 for cookie handling overview.