[1.5.x] Don't use : as an invalid cookie character

Since http://bugs.python.org/issue2193 has been resolved in favour of
the colon in cookie names, we need to test invalid cookie removal using
a different character. "@" is still considered invalid by all sources.

Backport of 419e2137fabdcadadc728cb9bd94af929157dc3b from master