Mutex must be held even for a read-access of a cookie state, as there may be a race with write in other thread.