def sanitize_cookies(env)
      return unless env['HTTP_COOKIE']

      env['HTTP_COOKIE'] = env['HTTP_COOKIE']
        .split(/[;,] */n)
        .map { |cookie| sanitize_uri_encoded_string(cookie) }
        .join('; ')
    end
def sanitize_cookies(env)
      return unless env['HTTP_COOKIE']

      env['HTTP_COOKIE'] = env['HTTP_COOKIE']
        .split(/[;,] */n)
        .map { |cookie| sanitize_uri_encoded_string(cookie) }
        .join('; ')
    end
Cookies need to be split and then sanitized as url encoded strings
 since the cookie string itself is not url encoded (separated by `;`),
 and the normal method of `sanitize_uri_encoded_string` would break
 later cookie parsing in the case that a cookie value contained an
 encoded `;`.