Any additional URL parameters after a & were previously dropped.

This reduces the possibility of a malicious URL redirecting to another
domain.

The intent of this cookie isn't actually to track sessions, so eliminate
any privacy impact by using a fixed number instead.

If an expensive request comes in from anyone without a cookie attached,
redirect to a page where the cookie is set using JavaScript, then
redirect back. This should block robots from these paths, most of which
do not support JavaScript. The collateral damage is that a JavaScript
browser is now required for users to access those paths.  The contents
of the cookie is not currently checked, merely that it is set.

These two are hammering the site right now, causing severe slowdowns.
Restrict the paths they are allowed to access.