So, is this regex doing something that I am missing, or is it a broken regex that was placed in a seldom-used subroutine that no one has bother correcting? Can anyone shed some light...

I have a feeling that it is broken in the sense that it doesn't do what (i/you/others suspect) it was intended to do.

However.... based on the cookie header format this code seems pretty unneccessary. It was probably added as a "sanity check" in case some external client/server was over-zealous with it's white space.