cookies: strip the numerical ipv6 host properly

The commit e650dbde that stripped off [brackets] from ipv6-only host
headers for the sake of cookie parsing wrongly incremented the host
pointer which would cause a bad free() call later on.