Backport PR #4762: whitelist alphanumeric characters for cookie_name

should fix #4761