Hi, not sure even whether CookieUtils is supposed to be used outside wicket. But if so, it has some API flaws.
The CookieUtils class has
public final void save(String key, final String... values)
but no public load method to load the saved multiple values. Clients can load the whole string and split themselves, but that's dirty. And using FormComponent.VALUE_SEPARATOR seems wicket-specific anyway (and is not safe against values with that separator), so maybe that method should be protected, not public.
in save() also seems dodgy, but seems to have no effect (defaultSettings still work).
Finally it is a bit weird that there is no access to the underlying Cookie itself, with it's getDomain() etc methods. For Developers it might be nice to work with the cookie avoiding the boilerplate code, so maybe getCookie() could be made public instead of private