Switch frontend permission handling to store permissions in a separate cookie.

Reduces the risk of hitting the 4KB cookie limit