We use the cookie parser to remove the code-server token but by default
it encodes using encodeURIComponent, which encodes more than is strictly
necessary and can break proxied applications.
Now we pass the cookies through unchanged (other than removing the
code-server token).
Fixes#7927.