Pull reference code out of apache's own util_cookies.c (which is
unfortunately not part of libapr so we can't link to it in our tests).

Also use libapr for url-escaping, getting rid of some ugly code.