Parses the Cookie header and returns a JSON object with a cookies key
containing a map of cookie name-value pairs.

Example Response

{ "cookies": { "session": "abc123", "theme": "dark" } }

GET /cookies/delete. Each query-parameter name expires the matching cookie
(Max-Age=0), and the response is a 302 redirect to /cookies.

Example

DELETE /cookies?foo&theme expires both cookies and redirects.

Each query parameter name is used to expire the corresponding cookie.
The value of the query parameter is ignored.

Example

GET /cookies/delete?foo&theme expires both cookies and redirects.

Each non-reserved query parameter becomes a Set-Cookie response header.
Reserved keys add attributes applied to every cookie set in the request:
secure, httponly, samesite=<Strict|Lax|None>, max_age=<seconds>,
path=<path> (default /), domain=<domain>. After setting the cookies,
responds with a 302 redirect to /cookies so the client can see the result.

Example

GET /cookies/set?session=abc&secure&httponly&samesite=Strict&max_age=3600
sets session=abc; Path=/; Max-Age=3600; SameSite=Strict; Secure; HttpOnly.

Introduces a delay of n seconds before sending a response.
The delay duration n is extracted from the path.

Security

The maximum delay is capped at MAX_DELAY_SECONDS (300 seconds) to prevent
denial-of-service attacks where malicious requests could hold connections open indefinitely.