Use tough-cookie CookieJar sync API

This restores backwards-compatibility with `jar` parameters (i.e. jar.setCookie takes two parameters and is guaranteed synchronous).

The async API for tough-cookie can't be used without major changes to `request` itself, so I've left that for another day.