Fix Token serializer
Make Extractor more testable

Pull out getCookieData, getUserAgent, and validate or hmac string into
the utility class to make the extractor more reliably testable.