Bug 435067 - avoid NPE in XSRFPreventionFilter

Jetty returns an empty array from HttpServletRequest#getCookies() when
no cookies are present, but other servers may return null.