add customizable `always_ridicule` value, and cookie setting endpoint

This value shouldn't be emitted in a response, otherwise it's kind of pointless to set a custom value. We should have a form input that lets the user enter this value.