Add a sanity check that the cookie_len returned by app_gen_cookie_cb is
valid.
Reviewed-by: NAndy Polyakov <appro@openssl.org>