add client side cookie switch to force mock enabling

Should enabled be tri-state? I.e. set to `false` means ignore the cookie and never enable. From a security/stability standpoint it seems like it may be safer to allow for a completely shutoff mode so 3rd parties can't muck around with the mock code paths.