bump cookies to 0.4.0

no longer need to do that keygrip stuff, though i’m more inclined to
remove all the error checking.
cleanup dev deps