Fix a few minor memory leaks

Also, vpninfo->cookie was an "owned" string in XML POST mode, but a
pointer into the cookie list in legacy mode.  Now it is always an "owned"
string and will be freed properly.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>