Sure, it could be passed along in whatever it is that gets sent to your CookieCutter sub. Personally I would print out whatever is going in to see if it is clean - I'd wager if you have such a problem with politics and legacy code, you can have problems anywhere.

Also, neat trick while playing with cookies.

javascript:alert(document.cookies);

in your browsers location bar will throw up an alert box with all your cookies for that site and their values.

EEjack