Limit cookie value size to 4096 bytes.

Too big cookies will make most web servers reject requests.
Convert existing cookie test to test framework

* The remaining stress-test is a benchmark, and has no success/failure
result. Leave it this way for now.
HttpTime: don't try to parse timezone

* Cookies sometimes come with the UTC timezone, or no tz info at all.
* No other timezone seems to be used

This allows better matching of cookies which would otherwise be kept
only as session cookies.
More relaxing of cookie-setting rules

* Allow non-secure page to set (but not read) secure cookies
* Allow pages to set cookies for subdomains (but not access them)
Rename url directory to "service"

* All "services kit" tests will move there.