Allow commas in cookie values

[trowski]

While commas in cookie values are not allowed by RFC6265 (see 4.1.1 Syntax), it seems many modern browsers including Chrome and Firefox allow commas to be in cookie values.

Issue in .NET: dotnet/runtime#58773
Issue in Go: golang/go#7243

Ping @PeeHaa, since you raised this issue.

[bwoebi]

I think it does not pose a problem to accept these (sending probably should still encode).
So, looks good to me :-)

[trowski]

If we want to still encode commas, then I'd have to modify the toString() method to replace , with %2C. That's a bit weird IMO since we don't encode the rest of the value, as we're expecting an encoded value to be provided in the first place.

[trowski]

Closing this in favor of maintaining strict compliance with the standard.

If necessary, one can always parse the comma-containing cookie header sent from the client and use Request::setCookie() to manually set the necessary cookie before another middleware or request handler. This would work well in the situation where the SessionMiddleware couldn't locate the session cookie due to another invalid cookie bundled with the session cookie in the same header.