Use prefix for cookie name to prevent detection of set cookies

[dlongley]

See: https://jub0bs.com/posts/2022-09-11-existence-oracle-for-secure-cookies-on-insecure-web-origins/
See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#cookie_prefixes

[dlongley]

We should be using __Host- for the cookie name by default.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes