Let the app read the SYN cookie before handling a new packet.

We could probably read the cookie a bit earlier, but for now that the simplest way to do it.