Validate API contracts

[rusty1968]

I noticed that the cookie creation functions use debug_assert! for bounds validation.

These should be runtime checks since they validate API contracts rather than internal implementation assumptions. Debug assertions are compiled out in release builds, which could lead to undefined behavior if the bounds checks fail in production.

[embediver]

The asserts you refer to are not in public functions so not an outward facing API.
But yes, this should probably be solved in a cleaner way.

I'll change this together with #10.