implement document.cookie more properly

 (supporting multiple cookies, but not for options like path, max-age, and so on)