It would be useful if expressions could extract values out of a Cookie header, and the code is already waiting to be reused in mog_log_config.