Fixes #4083 for OWA brute force

In the reported case, the expected cookies were not present on the response, thus, the second split was trying to split a `nil`. This solves the immediately problem by a) splitting up the splits into discrete sections, and b) `NilClass#to_s`'ing the result of the first split.

This makes the split safe. Now, there may be a larger issue here where you're not getting the expected cookies -- it sounds like the target in this case is responding differently, which implies that the module isn't going to be effective against that particular target. But, at least it won't crash. It may merely try fruitlessly the entire run, though. I can't know without looking at a pcap, and in the reported case, a pcap seems unlikely since this was a bug found in the field.

## Verification

- [ ] Attempt a bruteforce against an OWA instance with a known good and known bad credential set. In order to mirror the reporter's environment, OWA 2010 should be used.

If this PR doesn't break the existing test cases, it should be good enough to ship. If you can reproduce the original problem, that would be better, but I feel like that will involve a lot of guesswork.

/cc @Viss (the original reporter of #4083)