Previously any request could have the cookie store ID header set, resulting in Toolbox sending cookies that the originator isn't supposed to have access to. By instead generating a random ID for the header value and storing the cookie store ID in an object keyed by this random value, we can ensure that only Toolbox requests will have their `Cookie` headers rewritten.