#680186 use_cookie + allow_invalid_id doesn't work with malformed cookies