Do not CGI.unescape cookies sent in requests.

It isn't appropriate to call CGI.unescape on cookie values: any URI
encoding performed by servers on cookies should remain that way to avoid
sending invalid characters in the Cookie request HTTP header. (e.g. If
you send a cookie containing '%0A', it should send those three octets,
not a newline character.)

Fixes #89
Do some sanity checks on cookie names and values.

Validate that cookie names and values don't flagrantly violate RFC 6265
by containing things like control characters or ';'. This will help
prevent users from accidentally breaking boundaries of cookies or the
cookie header.

If you really want to send scary characters, you can set the Cookie
header directly.