whitelist alphanumeric characters for cookie_name

should fix #4761