I know this isn't your doing, but I really hate this sprintf statement :-)

Would you mind making this something like:

headerString = apr_psprintf(r->pool, "%s=%s%s;Path=...",
  cookieName,
  cookieValue,
  (secure ? ";Secure" : ""),
  pathPrefix,
  urlEncode(r, getCASScope(r), " "),
  (c->CASCookieDomain != NULL ? ";Domain=" : ""), (c->CASCookieDomain != NULL ? c->CASCookieDomain : ""),
  (c->CASCookieHttpOnly != FALSE ? "; HttpOnly" : ""),
  (NULL == expireTimeString ? "" : "apr_psprintf(...));

(basically, to have each chunk of the modifiers on their own line, indented, so it's easier to read and map - the exception being the domain string, which I almost feel should be pulled out and apr_psprintf'd into a single char * that can be dropped in-line).