After reviewing more of the cookie code, I noticed we are case sensitive on some parts, namely secure and httponly in some cases.

https://tools.ietf.org/search/rfc6265 p18-20 discuss that these fields should match case insensitively but we use case sensitive string keys in mock.rb and possibly other places.

I suggest we lower case these to normalise the fields, since it seems like this is probably what we expect 99% of the time.