A bit more test coverage for the cookie message

Run one of the scenarios with poltergeist as well as rack-test, and add some missing coverage for the controller.