Check for allowed characters, not encoding in cookies