Robust handling of PFS cookies

[nl0]

Description

Lazily (re)set PFS cookie when required

TODO

• [x] Changelog entry (skip if change is not significant to end users, e.g. docs only)

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 84.48%. Comparing base (7773230) to head (831c446). Report is 7 commits behind head on master.

:exclamation: Current head 831c446 differs from pull request most recent head fee9d7d. Consider uploading reports for the commit fee9d7d to get more accurate results

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #3962 +/- ## ========================================== - Coverage 90.91% 84.48% -6.43% ========================================== Files 35 40 +5 Lines 5952 3488 -2464 ========================================== - Hits 5411 2947 -2464 Misses 541 541 ``` | [Flag](https://app.codecov.io/gh/quiltdata/quilt/pull/3962/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=quiltdata) | Coverage Δ | | |---|---|---| | [api-python](https://app.codecov.io/gh/quiltdata/quilt/pull/3962/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=quiltdata) | `?` | | | [lambda](https://app.codecov.io/gh/quiltdata/quilt/pull/3962/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=quiltdata) | `84.48% <ø> (?)` | | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=quiltdata#carryforward-flags-in-the-pull-request-comment) to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[nl0]

For some reason, it still doesn't work for me

1. you need an updated registry for that to work (PR in review)
2. it won't work on localhost bc the cookie has strict policy -- it only works for the same (sub?)domain