E_NOTICE generated by unserialize on strings from untrusted data

Although mostly addressed by #1369660: "Namespace" cookie names to support subdomains. → , we have still see situations where users have invalid cookies (usually from the wrong domain) cause notices from Bakery. A malicious user could do the same, which we have tests for internally. These notices cause failures in our test system, a minor issue of course.

I couldn't help but notice a lot of repetition around the code to decrypt and unserialize "cookies", so I hope to DRY that up as well.