js_cookie module not enabled when updating from CAS 2.x to 3.x

Yea this was missed.

We have only one feature that uses this, which is the client-side authentication method for gateway authentication. I imagine most sites don't use this, so we should consider not installing the module for everyone.

Updated the proposed resolution...

Is it a better idea to move this functionality into a submodule?

Maybe! It may be a bit tricky to pull the logic out of the main module.