AF Cookie should be reused within the context of same request.

Also adding some more functional tests for af.
Will GetCookieToken be called multiple times? If so then consider checking HttpContext.Items first. If it's not there then check the cookie and store the deserialized value in Items.