Change eval(cookies) to json.loads(cookies)

Per my comment at https://news.ycombinator.com/item?id=7225580, this fixes an RCE vulnerability in the cookie handling. If you rely on an attacker not being able to set cookies for security, you're going to have a bad time.

Also, eval(cookies) will choke on valid JSON. See http://stackoverflow.com/a/1083302