[SandObserver]

Summary

• Replace parseCookies with sessionTokens, which returns every ds value, and accept the first valid, unrevoked one in readSession.
• Return a fixed sentence from the Connections widget when the address guard blocks a request.

Testing
All green. Added tests for a shadowing cookie and the blocked-address reply.

Changelog

Security

• A session cookie set by another host on the same parent domain no longer signs the owner out.
• The Connections widget no longer names an address the guard blocked.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.