Fix request cloaking

The request params "xbug" and "clear_cache" are passed to the page when it's loaded via profiler, this can mess with "sensitive" pages, that also use $_GET/$_POST, to prevent this I outsourced these config params to the $_COOKIE variable, like this only things get sent to the page that are actually intended =)