fix: add a guard against maliciously-sized cookies

[andyburke]

This adds a guard to limit cookie strings we will attempt to parse to 32768 characters. I believe this is in compliance with the RFC:

Limits

Practical user agent implementations have limits on the number and size of cookies that they can store. General-use user agents SHOULD provide each of the following minimum capabilities:

o At least 4096 bytes per cookie (as measured by the sum of the length of the cookie's name, value, and attributes).