fix null pointer dereference (segfault) when Cookie header is empty

Some days we get hundreds of Apache segmentation faults -- other times weeks go by without one.  It turns out that getCASCookie croaks if a client sends an empty Cookie: header.  This patch fixes the problem.  I added a test too.

I agree, that's simpler and better.