JDK supports cookie handling natively via the CookieManager. Use this and discard present code. Remove the per-site use-cookie configuration and replace with standard cookie policies: all, none, or originating server only.
This will introduce a minor binary incompatibility, as the present Cookie class will cease to be used, and java.net.HttpCookie will appear instead in a couple of places in the Site interface and throughout the Storage subsystem. There will then be no real reason to have CookieDAO and friends at all. Alternatively a JDBC CookieStore implementation could be created.
Diff: