deserializeCookies: convert null -> ""