Change eval(cookies) to json.loads(cookies)

This fixes an RCE vulnerability in the cookie handling. If you rely on an attacker not being able to set cookies for security, you're going to have a bad time.

Also, eval(cookies) will choke on valid JSON. See http://stackoverflow.com/a/1083302
Merge pull request #20 from JordanMilne/master

Change eval(cookies) to json.loads(cookies)